Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

OnyxException's avatar

419 error, but csrf token is set.

Im sorry for this post, but I keep getting the 419 error on my live environment. While testing everything was fine, but on my production server I keep getting the 419 error.

Yes, the perms for storage are set. Yes, @csrf is in the form. Yes, SESSION_DOMAIN is also set Yes, APP_URL is correctly set https:// example. com

The only difference is that I use https...

0 likes
8 replies
enoch91's avatar

@onyxexception if there's an issue with SSL or HTTPS configuration, it might cause problems with CSRF tokens. Make sure the HTTPS is properly set up and that your URLs use the "https://" scheme.

Also, Make sure the server time is correctly configured. A time discrepancy between the server and the client might result in CSRF token mismatches.

OnyxException's avatar

Not that I know of, the SSL certificate is valid, the server time matches. It works neither on my PC nor on my cell phone.

enoch91's avatar
enoch91
Best Answer
Level 2

Okay great! CSRF protection may fail if the page is loaded over HTTPS, but the form submission is done over HTTP or vice versa. Make sure that the entire site, including form submissions, is consistently served over HTTPS.

Also, Make sure that the SESSION_DOMAIN matches your production domain, including the correct protocol (https). Check your config/session.php

'domain' => env('SESSION_DOMAIN', null),

If you are using Laravel's caching, try clearing the configuration cache

php artisan config:clear

You might want to clear your browser cache or try accessing the site in incognito/private mode to rule out any browser-related issues.

1 like
Snapey's avatar

if your web server is apache, a problem I have seen a few times is stray output in a .php file can cause apache to not send cookies

Check that your site correctly sets a session cookie. You can see this in dev tools in your browser

OnyxException's avatar

Hello, thank you for answers. The issue was, that in config/session.php, domain was set with the default value 127.0.0.1 instead of the value from the .env.

rishabk's avatar

this can also happen if the local site is served on http and SESSION_SECURE_COOKIE=true. make sure to comment it or set false.

1 like

Please or to participate in this conversation.