4xx Client errors

419 Page Expired

A Laravel-specific status: the CSRF token was missing or no longer matched the session, so the form submission was refused.

Common causes

The form was open longer than the session lifetime (default 120 minutes).
A form without @csrf, or an AJAX request without the X-CSRF-TOKEN header.
Session cookies not saved: wrong SESSION_DOMAIN, SESSION_SECURE_COOKIE=true on http, or storage/framework/sessions not writable.
The page was served from a cache that stored an old token.

How to fix a 419 error

1
Add @csrf to every POST form; send the token from <meta name="csrf-token"> in AJAX headers.
2
Check SESSION_DOMAIN and SESSION_SECURE_COOKIE in .env, then php artisan config:clear.
3
Make storage/ writable (775) and check that the sessions table exists if SESSION_DRIVER=database.
4
Exclude pages with forms from full-page caches.

Fix Laravel errors on shared hosting Laravel log analyzer Search error fixes for 419

In Laravel

The TokenMismatchException becomes 419. Livewire refreshes the page or shows "This page has expired" in the same situation.

Check the status of a URL

The first line of the response shows the status code; -L follows redirects and shows each step.

curl -I https://example.com/page
curl -IL https://example.com/old-page

Frequently asked questions

What does HTTP 419 mean?

A Laravel-specific status: the CSRF token was missing or no longer matched the session, so the form submission was refused.

How do I fix a 419 error?

Add @csrf to every POST form; send the token from <meta name="csrf-token"> in AJAX headers. Check SESSION_DOMAIN and SESSION_SECURE_COOKIE in .env, then php artisan config:clear. Make storage/ writable (775) and check that the sessions table exists if SESSION_DRIVER=database. Exclude pages with forms from full-page caches.

How does Laravel handle 419?

The TokenMismatchException becomes 419. Livewire refreshes the page or shows "This page has expired" in the same situation.