I've found that there is a $request->session()->token() that is set, and it doesn't match the request->input('_token') causing VerifyCsrfToken to fail. Not sure where that session token is coming from?

• $request->input("_token") is set correctly as the token in the HTML form (from @csrf in the blade template)
• $request->session()->token() is set to something else entirely, causing tokensMatch() to be false

It seems that SESSION_DRIVER=database is causing the issue. If I set it back to SESSION_DRIVER=file it works but that won't work when deployed because I'm on AWS Lambda via Vapor.

Every request gets a new session _token and all rows in the sessions table have user_id set to null. It seems sessions stored in the database aren't persisting for each user. Anyone have a clue why?

Solution

1. in session.php I set "same_site" to "lax"

    'same_site' => "lax",

1. In Kernel.php the StartSession middleware was included in both $middleware and $middlewareGroups for "web". This was causing it to run StartSession twice and overwrite the existing session with a new one for each request. Removing the duplicate in $middlewareGroups "web" fixed it.

  protected $middleware = [
        \App\Http\Middleware\CheckForMaintenanceMode::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        \App\Http\Middleware\TrimStrings::class,
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
        \App\Http\Middleware\TrustProxies::class,
        \Illuminate\Session\Middleware\StartSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \Fruitcake\Cors\HandleCors::class,
    ];

    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\AuthenticateSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
         ------> these two below were the issue. removing them fixed it <------
            \Illuminate\Session\Middleware\StartSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        ],
    ];