Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

auxbus's avatar

How to investigate the rare 419 CSRF token error (axios requests only)

I have a site with hundreds of daily users. 99% of the time, CSRF tokens works just fine. Very occasionally (not even once per week), I'll get a Illuminate\Session\TokenMismatchException CSRF token mismatch error. How can I debug this further, since it's entirely handled by Laravel? Sessions are one of those magical things and the docs don't mention it. I added some logging and when this does happen - which is rare - I confirmed that:

  • This only occurs on axios calls (ajax)! What could be causing that, especially when it works the vast majority of the time?
  • The X-CSRF-TOKEN header doesn't match session()->token()
  • "By default, the resources/js/bootstrap.js file includes the Axios HTTP library which will automatically send the X-XSRF-TOKEN header for you." I confirmed this by printing window.axios.defaults.headers.common['X-CSRF-TOKEN'] to the console. It matched the value in <meta name="csrf-token" content="{{ csrf_token() }}"> (from the CSRF page)
  • The session is not expired. In fact, it was usually created semi-recently. In a recent instance, about 41 hours prior. I have SESSION_LIFETIME set to 43800, about a month

So here's where I'm stuck. The header should match, and does most of the time (99%), but occasionally, it does not. I am unsure how to fix or debug this, as none of it involves my own code. Help!

0 likes
3 replies
vincent15000's avatar

Not sure at all, but I also have a strange random behavior when logging in using Livewire (which uses under the hood JS).

I have noticed that the tokens sometimes remain saved in the session even when a uses logs out.

And this generates an error when trying to log in once again because there is already a token / session saved in the browser (which is sure not valid, but present).

I don't have found yet why the application has this behavior.

Robert007's avatar

if you are experience strange random behavior with token retention in the session when logging in using Livewire, there are a few things you can investigate:

Verify logout functionality: Double-check your logout implementation to ensure that it is properly destroying the session and clearing any associated tokens. Make sure you're using the correct method to clear the session data in your backend code.

Confirm Livewire behavior: Livewire is a JavaScript library, and it may have its own mechanisms for handling session management and token retention. Review the Livewire documentation or consult the Livewire community to understand if there are any specific considerations or known issues related to session management.

Check for session expiration: Ensure that your session has an appropriate expiration time set. If the session is not expiring correctly, it may lead to token retention even after a user logs out. Check your session configuration and verify that the expiration settings are properly configured.

Investigate browser caching: Sometimes, browsers can cache session data, including tokens. This can cause the behavior you described, where a token remains present even after logout. You can try adding appropriate cache-control headers to your responses to prevent caching of sensitive session data.

Test in different browsers: Test your application in different browsers to see if the behavior is consistent or specific to a particular browser. This can help identify if the issue is related to browser caching or session management.

Review Livewire lifecycle hooks: Livewire provides lifecycle hooks that allow you to customize the behavior of components. Check if there are any hooks being used in your Livewire components that might be affecting session management or token retention.

Debug with Livewire and JavaScript: Utilize Livewire's debugging features, such as Livewire logging or the debug mode, to inspect the Livewire component's behavior during login and logout. You can also use browser developer tools to debug the JavaScript code related to Livewire and inspect the session data.

Check server logs: Examine the server logs for any relevant error messages or indications related to session management or token retention. The logs may provide additional insights into the issue.

Seek assistance: If you're unable to identify the cause of the issue, consider reaching out to the Livewire community or the developers behind Livewire for further assistance. They may have encountered similar issues or have specific guidance based on your use case.

By investigating these areas, you can gain a better understanding of why the tokens sometimes remain saved in the session even after logout and work towards resolving the issue.

1 like

Please or to participate in this conversation.