"The page has expired due to inactivity" - Laravel 5.5

Question

My register page is showing the form properly with CsrfToken ({{ csrf_field() }}) present in the form).

Form HTML

<form class="form-horizontal registration-form" novalidate method="POST" action="{{ route('register') }}">
        {{ csrf_field() }}
        ....
</form>

I am using inbuilt authentication for the users. Have not changed anything except the routes and redirects.

When I submit the form (just after reloading also), it gives that The page has expired due to inactivity. Please refresh and try again. error.

My be I am missing a very small thing. But not sure what it is. Any help?

Update

Found the issue. The session driver was set to array. Changed it to file and the error is gone now. But what is wrong if I use array?

May have something to do with the storage_path not being writable. This is where it stores session data regarding tokens if you're using file based sessions. — Devon Bessemer, Sep 10 '17 at 14:38
Found the issue. The session driver was set to `array`. Changed it to file and the error is gone now. But what is wrong if I use array? — Sougata Bose, Sep 10 '17 at 14:42
or this url check https://stackoverflow.com/questions/39997180/laravel-5-3-tokenmismatchexception-in-verifycsrftoken-php-line-68/45354029#45354029 — Fatih TÜZEN, May 21 '18 at 10:56

score 173 · Accepted Answer · edited Jul 18 '19 at 21:57

173

If you're coming to this answer directly from a search, make sure you have already added the csrf token to your form with {{ csrf_field() }} like the OP.

If you have your session driver set to file:

May have something to do with the storage_path not being writable. This is where it stores session data regarding tokens if you're using file based sessions. The can be verified with is_writable(config('session.files'))

For the OP, the session driver was set to array. Array is for testing only. Since data is not persisted, it will not be able to compare the token on the next request.

The array driver is used during testing and prevents the data stored in the session from being persisted.

https://laravel.com/docs/5.5/session#configuration

Check config/session.php

Lastly, an issue I just had, we had a project which has the session domain and secure settings in config/session.php but the development site was not using HTTPS (SSL/TLS). This caused this generic error since sessions.secure was set to true by default.

edited Jul 18 '19 at 21:57

dtbarne

8,110
5
43
49

answered Sep 10 '17 at 14:44

Devon Bessemer

34,461
9
69
95

3

Ok. But for now it is in development. So if I use array, why it was giving me that error? – Sougata Bose Sep 10 '17 at 14:46
@SougataBose testing is not development. Array data is not persisted... – Devon Bessemer Sep 10 '17 at 14:46
That's the reason one should go through the DOCs properly.. :) – Sougata Bose Sep 10 '17 at 14:50
My problem was not solved. I did the basics truly. But I'm using custom providers and services. There is no problem when I call a controller method but when I run a service method in a controller that called with post request, the problem appears! – Behnam Azimi Dec 17 '17 at 22:26
1

I had a similar issue with sessions but in regards to testing. Turned out when I was using `Carbon::setTestNow($time);` in the tests I was not clearing it by using `Carbon::setTestNow();` afterwards. – riotCode Aug 01 '18 at 23:52

score 81 · Answer 2 · answered Sep 17 '17 at 07:55

81

I ran into the same issue in Laravel 5.5. In my case, it happened after changing a route from GET to POST. The issue was because I forgot to pass a CSRF token when I switched to POST.

You can either post a CSRF token in your form by calling:

 {{ csrf_field() }}

Or exclude your route in app/Http/Middleware/VerifyCsrfToken.php

 protected $except = [
        'your/route'
    ];

answered Sep 17 '17 at 07:55

Hyder B.

10,900
5
51
60

2

`csrf_field()` present in the form. The accepted answer describes the issue. Thanks. – Sougata Bose Sep 18 '17 at 04:37
1

In my case, I was receiving a POST from a 3rd party, so adding the csrf_field() was not an option. Since CSRF was not a factor in my case, adding an exception to this route solved the problem. Thanks. – Fábio Duque Silva Oct 31 '17 at 15:44
My problem was not solved. I did the basics truly. But I'm using custom providers and services. There is no problem when I call a controller method but when I run a service method in a controller that called with post request, the problem appears! – Behnam Azimi Dec 17 '17 at 22:28
1

Please do not disable CSRF verification! It's very important to protection to have. Learn how to properly send the token and protect your logged in users from malicious javascript that can submit actions on their behalf. – Devon Bessemer Apr 08 '18 at 00:17

score 12 · Answer 3 · answered Sep 10 '17 at 14:39

12

Try all of them.

composer dump-autoload
php artisan optimize
php artisan cache:clear
php artisan config:clear
php artisan route:clear
php artisan view:clear

answered Sep 10 '17 at 14:39

Sagar Chamling

1,038
1
12
26

Instead of try all above commands, use this package https://github.com/afrazahmmad/clear-all-cached-data – Afraz Ahmad Aug 13 '18 at 19:53

score 8 · Answer 4 · answered Nov 06 '17 at 13:01

8

This caused because of Illuminate\Session\TokenMismatchException look at this code sample how to handle it properly:

https://gist.github.com/jrmadsen67/bd0f9ad0ef1ed6bb594e

answered Nov 06 '17 at 13:01

yuklia

6,733
5
20
26

score 6 · Answer 5 · edited Jun 07 '18 at 04:26

6

My case was solved with SESSION_DOMAIN, in my local machine had to be set to xxx.localhost. It was causing conflicts with the production SESSION_DOMAIN, xxx.com that was set directly in the session.php config file.

edited Jun 07 '18 at 04:26

Stephen Rauch

47,830
31
106
135

answered Jun 07 '18 at 03:56

Andrés Ruiz

61
1
1

Which session driver you were using? `file` or `cookie`? – KeitelDOG Dec 05 '18 at 22:05

score 4 · Answer 6 · answered Sep 10 '17 at 14:30

4

Some information is stored in the cookie which is related to previous versions of laravel in development. So it's conflicting with csrf generated tokens which are generated by another's versions. Just Clear the cookie and give a try.

answered Sep 10 '17 at 14:30

Suresh Velusamy

2,338
19
24

did you able to see `` kind of code in generated html ? – Suresh Velusamy Sep 10 '17 at 14:40
It is there. Found the issue. The session driver was set to array. Changed it to file and the error is gone now. – Sougata Bose Sep 10 '17 at 14:43

Buddhi Kasun · Answer 7 · 2018-10-31T06:50:39.840

4

I change permission to storage and error was gone. It seemed lack of permission was the issue.

sudo chmod -R 775 storage/

edited Oct 31 '18 at 06:50

answered Feb 22 '18 at 15:31

Buddhi Kasun

59
7

2

Be careful using such open permissions recursively. I'd highly recommend against 775 for files. 755 for directories and 644 for files is the norm. – Devon Bessemer Jan 11 '19 at 15:18

score 4 · Answer 8 · answered May 13 '18 at 19:35

4

For those who still has problem and nothing helped. Pay attention on php.ini mbstring.func_overload parameter. It has to be set to 0. And mbstring.internal_encoding set to UTF-8. In my case that was a problem.

answered May 13 '18 at 19:35

andrew_jackson

125
4

Thank you very much! Your answer saved my brain from crashing) – Rustembek Kaliyev Dec 05 '19 at 09:43

score 3 · Answer 9 · answered Jan 17 '18 at 08:16

3

In my case, the site was fine in server but not in local. Then I remember I was working on secure website.
So in file config.session.php, set the variable secure to false

'secure' => env('SESSION_SECURE_COOKIE', false),

answered Jan 17 '18 at 08:16

Irfandi D. Vendy

894
12
20

score 3 · Answer 10 · answered Dec 28 '19 at 17:12

3

add @csrf in the form and also go to VerifyCsrfToken.php

app->Http->Middleware->VerifyCsrfToken.php

protected $except = [
        'paste your route here'
    ];

answered Dec 28 '19 at 17:12

Shery

59
4

Damitha Dayananda · Answer 11 · 2018-07-04T03:32:57.647

1

I have figured out two solution to avoid these error 1)by adding protected $except = ['/yourroute'] possible disable csrf token inspection from defined root. 2)just comment \App\Http\Middleware\VerifyCsrfToken::class line in protected middleware group in kernel

edited Jul 04 '18 at 03:32

answered Jul 03 '18 at 12:11

Damitha Dayananda

473
7
15

score 1 · Answer 12 · answered Jul 29 '19 at 18:36

Short answer

Add the route entry for register in app/Http/Middleware/VerifyCsrfToken.php

protected $except = [
        '/routeTo/register'
    ];

and clear the cache and the cache route with the commands:

php artisan cache:clear && php artisan route:clear

Details

Every time you access a Laravel site, a token is generated, even if the session has not been started. Then, in each request, this token (stored in the cookies) will be validated against its expiration time, set in the SESSION_LIFETIME field on config/session.php file.

If you keep the site open for more than the expiration time and try to make a request, this token will be evaluated and the expiration error will return. So, to skip this validation on forms that are outside the functions of authenticated users (such as register or login) you can add the except route in app/Http/Middleware/VerifyCsrfToken.php.

If that page processes user input then it should go through **CSRF** checks. — Sougata Bose, Jul 30 '19 at 05:05
@SougataBose Indeed, in that case I think it is best to use a captcha validator as Google reCAPTCHA — J.C. Gras, Jul 30 '19 at 14:40

score 0 · Answer 13 · edited Apr 25 '18 at 13:27

0

Be sure to have the correct system time on your web server. In my case, the vagrant machine was in the future (Jan 26 14:08:26 UTC 2226) so of course the time in my browser's session cookie had expired some 200+ years ago.

edited Apr 25 '18 at 13:27

Script47

14,230
4
45
66

answered Nov 27 '17 at 19:03

mim.ms

112
4

score 0 · Answer 14 · answered Jan 05 '18 at 14:59

0

I had the app with multiple subdomains and session cookie was the problem between those. Clearing the cookies resolved my problem.

Also, try setting the SESSION_DOMAIN in .env file. Use the exact subdomain you are browsing.

answered Jan 05 '18 at 14:59

Mladen Janjetovic

13,844
8
72
82

score 0 · Answer 15 · answered Jun 28 '18 at 10:12

0

set mbstring.func_overload = 2

it helped me

answered Jun 28 '18 at 10:12

Toxi Gen

1
1

score 0 · Answer 16 · answered Nov 08 '18 at 11:41

0

I had the same problem but the problem is not in the framework but in the browser. I don't know why but google chrome blocks cookies automatically, in my case. After allowed cookies the problem was resolved.

answered Nov 08 '18 at 11:41

M. A. Pervez

25
6

score 0 · Answer 17 · answered Apr 08 '20 at 04:35

0

Many time its happening because you are testing project in back date

answered Apr 08 '20 at 04:35

oparam

209
2
10

score 0 · Answer 18 · answered Jun 24 '20 at 06:07

0

Solution:

use incognito new tab then test it again.

reason:

in my case another user logged in with my admin panel

answered Jun 24 '20 at 06:07

saber tabatabaee yazdi

4,404
3
42
58

score 0 · Answer 19 · answered Aug 29 '20 at 08:48

0

I encountered the same issue on Linux-mint but then realized that the htdocs folder had no full permissions. So I changed the permissions of all the subdirectories in the htdocs folder by doing: sudo chown -c -R $USER:$USER /opt/lampp/htdocs/*

answered Aug 29 '20 at 08:48

Simon Angatia

688
1
10
16

score 0 · Answer 20 · answered Oct 18 '20 at 17:46

0

Sign in to connect to the server.

Search Error

An error has occurred: search false You don't have the peais.

Search request is longer.

answered Oct 18 '20 at 17:46

benjamin miller

1

2

Please be more specific in the steps OP needs to take. – Tom Groot Oct 18 '20 at 18:15

"The page has expired due to inactivity" - Laravel 5.5

20 Answers20

Linked

Related