Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

MrChrxs's avatar

CSRF keeps refreshing on Vapor

Hello,

I’ve recently moved a project from Forge to Vapor, it’s Laravel 8 with Inertia/Vue. I’m doing an axios call to a web route, and I’m getting a 419 CSRF token mismatch.

I’ve looked at the CSRF in the meta tag, and it’ll change every page refresh (unlike my local which is static) I’ve noticed it’ll go A, A, B, A, A, C, as a pattern.

We’re using GitHub Actions with Vapor too, and also got Cloudflare deployed.

Things I’ve tried; setting Session driver to Cookie/Database; setting session domain to “.domain.com” or “sub.domain.com”.

I’m not really sure why it’s happening. I’m very new to Vapor too.

0 likes
2 replies
Snapey's avatar

do you have more than one node?

If so, are you sharing session between the nodes

MrChrxs's avatar

@Snapey I don’t believe so, but how do I double check? Sorry if it’s a dumb question, I’ve not done the initial setup of Vapor.

Please or to participate in this conversation.