Fix this error

Laravel: 419 Page Expired

Dasun Kalupahana Updated November 10, 2026 104 views

Error

419 | Page Expired

Why it happens

Laravel rejects a POST, PUT, PATCH or DELETE request when its CSRF token is missing or does not match the one in the session. Common reasons:

The form has no @csrf field.
The page was open so long that the session expired (default 120 minutes).
An AJAX request does not send the X-CSRF-TOKEN header.
The session cookie is not saved: wrong SESSION_DOMAIN, SESSION_SECURE_COOKIE=true on plain http, or storage/framework/sessions is not writable.

How to fix it

Add @csrf inside every form that posts to Laravel.
For JavaScript requests, put the token in a meta tag and send it as the X-CSRF-TOKEN header (axios in a default Laravel app does this already).
Check .env: SESSION_DOMAIN must match your domain (or be empty), and SESSION_SECURE_COOKIE=true only works over https.
Make sure storage/ is writable, then run php artisan config:clear and try again in a fresh tab.

<form method="POST" action="/profile">
    @csrf
    ...
</form>

{{-- For fetch / axios --}}
<meta name="csrf-token" content="{{ csrf_token() }}">
<script>
    fetch('/profile', {
        method: 'POST',
        headers: { 'X-CSRF-TOKEN': document.querySelector('meta[name=csrf-token]').content },
    });
</script>

#laravel #csrf #sessions

Still stuck? Send us the full error and what you tried. We add the answers here.