Illuminate\Session\TokenMismatchException in vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken

Laravel is a strong PHP framework that comes with strong security features built in. CSRF (Cross-Site Request Forgery) protection is one of the most important security features in Laravel. However, developers often run into the TokenMismatchException error when they send AJAX requests or fill out forms. This error happens most of the time when the CSRF token that is needed is missing or not valid.

This article will explain what the Laravel TokenMismatchException error is, what usually causes it, and how to fix it in Laravel apps.

Understanding the Error

When the CSRF token that was sent with a request doesn't match the token that is stored in the user's session, Laravel throws a TokenMismatchException error. This token is used by Laravel to make sure that the request is coming from a trusted source.

Laravel checks the CSRF token every time a user submits a form or does something that changes data to stop bad attacks. Laravel stops the request and throws the TokenMismatchException error if the token is missing, expired, or not correct.

This security feature keeps people from submitting forms to your app without permission. Without this protection, attackers could do things for users without their permission.

This error can be annoying while you're working on something, but it actually means that Laravel's security system is working properly. All developers have to do is make sure that every form and AJAX request has the right CSRF token.

Common Causes

Below are some of the most common reasons why the TokenMismatchException error appears in Laravel projects.

1. Missing CSRF Token in Form

One of the most frequent causes is forgetting to include the CSRF token in HTML forms. Laravel requires every POST request to contain a CSRF token to verify the request.

If the token is not included, Laravel automatically rejects the request and throws a TokenMismatchException error.

2. AJAX Requests Without CSRF Header

Another common reason is sending AJAX requests without the required CSRF token header. Laravel expects the token to be included in the request header when making AJAX POST or PUT requests.

If the AJAX request does not include this header, Laravel cannot validate the request, and the error occurs.

3. Session Expired or Token Expired

Sometimes the error occurs because the user's session has expired. Since CSRF tokens are stored in sessions, when the session expires, the token also becomes invalid.

If a user submits a form after a long time or refreshes the page improperly, the CSRF token may no longer match the session token.

How to Fix the Error

There are several ways to fix the TokenMismatchException error in Laravel. Below are the most reliable solutions.

1. Add CSRF Token in Forms

Whenever you create a form in Laravel, you must include the CSRF token inside the form. This allows Laravel to verify that the request is legitimate.

You can add the token using a hidden input field:

<input type="hidden" name="_token" value="{{ csrf_token() }}">

What is this?

In Laravel Blade templates, you can also use the simpler directive:

@csrf

This automatically generates the hidden token field.

2. Add CSRF Token in AJAX Requests

If you are using AJAX requests, you must include the CSRF token in the request headers before sending the request.

Example:

$.ajaxSetup({

   headers: {

'X-CSRF-TOKEN': $('meta[name="csrf-token"]'). attr('content')

   }

});

Also, make sure you have the CSRF meta tag in your HTML layout:

<meta name="csrf-token" content="{{ csrf_token() }}">

What is this?

This ensures that every AJAX request contains the required CSRF token.

3. Refresh Page to Generate New Token

If the error occurs due to an expired session, simply refreshing the page will generate a new CSRF token. After refreshing, the form submission should work properly.

This solution is helpful when users leave a form open for a long time and submit it after the session expires.

4. Disable CSRF Verification

Laravel allows developers to disable CSRF verification for specific routes, but this should only be done when absolutely necessary, such as for third-party webhooks.

To disable verification, open the following file:

/app/Http/Middleware/VerifyCsrfToken.php

Inside this file, you will find the $except array:

protected $except = [

    '/',

];

You can add routes here that should bypass CSRF verification. However, disabling CSRF protection can expose your application to security risks, so it should be avoided whenever possible.

Conclusion

The TokenMismatchException error in Laravel is a common issue that occurs when the CSRF token is missing, invalid, or expired. Laravel uses this token to protect applications from malicious attacks and unauthorized requests.

Most of the time, the error happens because developers forget to include the CSRF token in forms or AJAX requests. Adding the @csrf directive in forms or configuring AJAX headers correctly usually resolves the problem.

It is also important to understand that CSRF protection is a critical security feature in Laravel. Disabling it should only be done in special cases where verification is not required.

By properly implementing CSRF tokens in your forms and AJAX calls, you can easily prevent the TokenMismatchException error and maintain a secure Laravel application.