Clash Royale CLAN TAG

laravel 5.5 The page has expired due to inactivity. Please refresh and try again

I'm new with Laravel and I have a problem which I don't understand.
I have а log form in my project and my method is POST. When I try a request the result is: 'The page has expired due to inactivity. Please refresh and try again.' ,but if I change the method to GET, it works fine. Can someone tell me why is that and how to fix it, because of course i need post method.

19 Answers
19

This problem comes from the CSRF token verification which fails. So either you're not posting one or you're posting an incorrect one.

The reason it works for GET is that for a GET route in Laravel, there is no CSRF token posted.

You can either post a CSRF token in your form by calling:

{{ csrf_field() }}


Or exclude your route in app/Http/Middleware/VerifyCsrfToken.php:

app/Http/Middleware/VerifyCsrfToken.php

protected $except = [
'your/route'
];


VerifyCsrfToken.php

In my case, I've got the same error message and then figured out that I've missed to add csrf_token for the form field. Then add the csrf_token.

csrf_token

csrf_token

Using form helper that will be,

{{ csrf_field() }}


Or without form helper that will be,

<input type="hidden" name="_token" value="{{ csrf_token() }}">


If that doesn't work, then-

Refresh the browser cache

and now it might work, thanks.

Update For Laravel 5.6

Laravel integrates new @csrf instead of {{ csrf_field() }}. That looks more nice now.

@csrf

{{ csrf_field() }}

<form action="">
@csrf
...
</form>


Anytime you define an HTML form in your application, you should include a hidden CSRF token field in the form so that the CSRF protection middleware can validate the request. You may use the csrf_field helper to generate the token field:

csrf_field

<form method="POST" action="/profile">
{{ csrf_field() }}
...
</form>


It doesn't work, then Refresh the browser cache and now it might work,

For more details open link :- CSRF Protection

UPDATE:

With Laravel 5.6 using Blades templates, it's pretty easy.

<form method="POST" action="/profile">
@csrf
...
</form>


For more details open link :- CSRF Protection in Laravel 5.6

i had same problem. use 'clear browsing data' in chrome. maybe solve your problem.

Verify that your config/session.php file contains this line

'domain' => env('SESSION_DOMAIN', null),


Then remove the SESSION_DOMAIN line in your .env file

SESSION_DOMAIN

This happens because you are using the default CSRV middleware from Laravel's installation. To solve, remove this line from your Kernel.php:

AppHttpMiddlewareVerifyCsrfToken::class,


This is fine if you are build an API. However, if you are building a website this is a security verification, so be aware of its risks.

Just place this code inside the form

<input type = "hidden" name = "_token" value = "<?php echo csrf_token() ?>" />


I was facing the same error so i just removed this line from my .env file

SESSION_DRIVER=yourwebsite.com

if your config is set: SESSION_DRIVER=file you have to check if your session directory is writable. Check storage/framework/session

Place {{csrf_field()}} Into your form tag

{{csrf_field()}}

form

In my case the same problem was caused because I forgot to add > at the end of my hidden input field, like so: <input type="hidden" name="_token" value="{{ Session::token() }}"

>

<input type="hidden" name="_token" value="{{ Session::token() }}"

So, I fixed it by adding it:

<input type="hidden" name="_token" value="{{ Session::token() }}">


It's Funny but it works for me. i realised this is Caused because of default HTML TAG in laravel code.
Use /* */ or {{-- --}} instead

Or Try to Remove Recently Html Coment in you code...
Or change Html Comment to Php Comment...
Or try to run Any Worng artisan command like php artisan clean browser And See if it output any HTML Commented data along with it error...

We got it working by copying the routes from Router.php instead of using Auth::routes(), these are the routes you need:

Route::get('login', 'AuthLoginController@showLoginForm')->name('login');
Route::post('login', 'AuthLoginController@login');
Route::post('logout', 'AuthLoginController@logout')->name('logout');

// Registration Routes...
Route::get('register', 'AuthRegisterController@showRegistrationForm')->name('register');
Route::post('register', 'AuthRegisterController@register');

// Password Reset Routes...
Route::get('password/reset', 'AuthForgotPasswordController@showLinkRequestForm')->name('password.request');
Route::post('password/email', 'AuthForgotPasswordController@sendResetLinkEmail')->name('password.email');
Route::get('password/reset/{token}', 'AuthResetPasswordController@showResetForm')->name('password.reset');
Route::post('password/reset', 'AuthResetPasswordController@reset');


In my case , I added ob_start(); at the top of my index.php on server and everything seems to be working fine.

I know this question has been satisfactorily answered, but I wanted to mention a fix that worked in my case. I added {{ csrf_field() }} and it still didn't work.

{{ csrf_field() }}

Then I remembered that I blocked all cookies for development purposes, which can be nice when you change the page and want to refresh it.

Once I changed the settings to stop blocking all cookies in MS Edge browser the problem went away.

MS Edge browser

Tried different solutions to solve the problem for several weeks without success.

The problem I was facing was caused by upgrading from laravel 5.0 to 5.5 and forgot to update config/session.php

If anyone is facing the problem, try to update the config/session.php to match the version on Laravel you are running

my problem solved by just adding @csrf in form tag

@csrf

Laravel 5.6 doesn't support {{ csrf_field() }} just add @csrf in place of {{ csrf_field() }}

Laravel 5.6

{{ csrf_field() }}

@csrf

{{ csrf_field() }}

larvel_fix_error.png

it is very simple. go into
App/Kernel.php and comment
AppHttpMiddlewareVerifyCsrfToken::class,

Still anyone have this problem, use following code inside your form as below.

echo '<input type = "hidden" name = "_token" value = "'. csrf_token().'" >';


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.