Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

qerim's avatar
Level 1

Session Cookie not setting locally, leading to csrf Token mismatch

I have setup Homestead locally and have an exact system spec running on Digital Ocean (same OS[Ubuntu 16.04], same Nginx[1.10.0]/PHP [7.0], MySQL version).

Locally I'm having issues with Forms being posted. It leads to the common "TokenMismatchException in VerifyCsrfToken" error. I have tried everything, putting the hidden csr field in the form, in the tag and all other recommendations.

I managed to ignore and get around this by adding '/*' in the VerifyCsrfToken.php file. However I've started building the Admin panel with login form, and I cannot successfully login without clicking the "Remember Me" checkbox on the form.

On the Digital Ocean server, everything works perfect, no csr/login issues.

I checked the cookies today, and on the Digital Ocean server the laravel_session cookie is being set correctly, while locally using homestead it is no present at all.

I have checked my directory permissions, cleared the laravel and browser cache, generated a new key, and still no luck.

I think the cookie is not being set due to domain config. I tried changing the default 'null' to my local domain in Sessions.php, but no luck. My hosts file:

"192.168.10.10 app.dev"

My Laravel 5.2 install is pretty fresh, I have not edited core files, just added new routes/views and controllers.

I am not sure what to try anymore, and this has been bugging me.

Any assistance is appreciated.

0 likes
4 replies
Snapey's avatar

Is anything being written to the storage/framework/sessions folder?

Thats one that needs the permissions correct.

qerim's avatar
Level 1

It's empty. It has the same permission (777 root:root) as cache and views folder. Only the views folder populates with data. The cache and sessions remain empty locally. I know on the Digital Ocean I have 777 root:www-data, sessions and views populate fine.

qerim's avatar
qerim
OP
Best Answer
Level 1

OK. Finally came across my mistake.

At some point I had edited my local .env file with the following:

CACHE_DRIVER=array

SESSION_DRIVER=array

I switched from array to file and everything is fine now!

faniabdo99's avatar

Ok, I had the same issue, csrf works on live but not locally, my issue was related to HTTPS since my local .test domain has no encryption so I had to set SESSION_SECURE=false in order for the token to be set. I know this is not exactly an answer to your question but I thought it might help someone.

Please or to participate in this conversation.