Laravel Shift 10.x to 11x CSRF Token Mismatch

@LaryAI Answer #7 turned out to be the solution. I for some reason refused to think that would have anything to do with the problem. I should have just followed all these steps more closely. Oh well. Glad it's fixed! =)

@LaryAI on laravel 11 the kernal file doesn't exist anymore so how to define the middleware and where i can find the middleware classes?

@ZyadYhia You can keep the kernel file between versions 10 and 11

@ZyadYhia Middleware can now be defined in /bootstrap/app.php

Note: Using Laravel Shift is actually very worth it for the 10 to 11 upgrade, it takes care of all of this for you!

<?php

use Illuminate\Console\Scheduling\Schedule;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withProviders([
        \Intervention\Image\ImageServiceProvider::class,
    ])
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        $middleware->web(append: [
            \App\Http\Middleware\HandleInertiaRequests::class,
            \Illuminate\Http\Middleware\AddLinkHeadersForPreloadedAssets::class,
        ]);
    })
    ->withSchedule(function (Schedule $schedule) {
        $schedule->command('backup:clean')->daily()->at('2:00');
        $schedule->command('backup:run --only-db')->daily()->at('2:05');
        $schedule->command('backup:monitor')->daily()->at('2:10');
    })
    ->withExceptions(function (Exceptions $exceptions) {
        // 
    })->create();

@fylzero FWIW... anyone coming here from a 9 -> 10 -> 11 upgrade (my path -- not sure where it got messed up) My /bootstrap/app.php was old so I copied a fresh version in and it worked. I deleted app/Http/Kernel.php for good measure and it didn't do anything...

PS. I don't think it matters, but I'm using Breeze for Inertia + Vue

@Tray2 I did, no luck.

@fylzero I guess you already cleared all cached files?

@Tray2 tried all of the individual commands as well as the full php artisan optimize:clear, still throwing the error. It doesn't seem like the csrf is being passed with the request headers.

@fylzero Have you tried updating bootstrap app with:

<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Support\Facades\Route;

return Application::configure(basePath: dirname(__DIR__))
                ->withRouting(
                        web: __DIR__ . '/../routes/web.php',
                        commands: __DIR__ . '/../routes/console.php',
                        using: function () {
                            Route::middleware('web')
                            ->namespace('App\Http\Controllers')
                            ->group(base_path('routes/web.php'));
                        },
                        health: '/up',
                )
                ->withMiddleware(function (Middleware $middleware) {
                    $middleware->group('web', [
                        \Illuminate\Cookie\Middleware\EncryptCookies::class,
                        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
                        \Illuminate\Session\Middleware\StartSession::class,
                        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
                        \Illuminate\Foundation\Http\Middleware\ValidateCsrfToken::class,
                        \Illuminate\Routing\Middleware\SubstituteBindings::class,
                        \Illuminate\Session\Middleware\AuthenticateSession::class,
                    ]);
                })
                ->withExceptions(function (Exceptions $exceptions) {
                    //
                })->create();

Sorry, it's formatted in IDE, couldn't get it pasted correctly.

https://laravel.com/docs/11.x/middleware#manually-managing-laravels-default-middleware-groups

@jlrdw Tried making these changes and nothing worked - I think the issue is that the X-Xsrf-Token request header isn't being sent. I feel like back in the day this was added in the app.js but even looking at the pre-Shifted application I can't seem to figure out where that is grabbed on the front end and passed in the request headers. Might be an issue with Inertia or axios. I don't know much about this tbh.

@puklipo using Sanctum, Jetstream w/ Vue + Inertia, I did slim down the application, no modifications to $except.

@fylzero Normally axios already sets the csrf token to all requests but have you tried to set the default header?

axios.defaults.headers.common['X-CSRF-TOKEN'] = add_token_here;

@gych I was thinking of doing this and then looked at the Inertia docs: https://inertiajs.com/csrf-protection

They specifically remove this in Laravel due to how Inertia is set up under the hood. I. also just have no idea why this would have broken with this upgrade.