How to Fix the 419 Page Expired Error in Laravel (7 Causes & Solutions)

The 419 Page Expired error is one of the most common errors Laravel users run into, especially when clicking a form submit button, logging in, or sending a request via AJAX. The good news: this error is almost always related to the CSRF token or the session, and it can be fixed quickly once you know the cause.

In this article we go through the 7 most common causes of the 419 error in Laravel along with their solutions, from the most frequent to the rarest.

What Is the 419 Page Expired Error?

The HTTP status 419 in Laravel means CSRF token mismatch — the security token sent by the form does not match (or is missing) the token stored in the session. Laravel uses the CSRF token to protect your app from Cross-Site Request Forgery attacks, so every POST/PUT/PATCH/DELETE request must include a valid token.

1. Forgetting to Add @csrf to the Form

This is the number one cause. Every form with a method other than GET must include the @csrf directive.

<form method="POST" action="/save">
    @csrf
    <input type="text" name="title">
    <button type="submit">Save</button>
</form>

Without @csrf, Laravel receives no token at all and immediately rejects the request with a 419.

2. AJAX Requests Without a CSRF Token

When sending data via fetch or jQuery/Axios, the token must be sent through the X-CSRF-TOKEN header. First, put the token in a <meta> tag in your layout:

<meta name="csrf-token" content="{{ csrf_token() }}">

Then send it in the request header. Example with Axios:

axios.defaults.headers.common['X-CSRF-TOKEN'] =
    document.querySelector('meta[name="csrf-token"]').content;

Example with fetch:

fetch('/save', {
    method: 'POST',
    headers: {
        'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]').content,
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({ title: 'Hello' })
});

3. The Session Has Expired (Form Left Open Too Long)

If a page is left open for a long time and then submitted, the session may have already expired. Extend the session lifetime in config/session.php or via .env:

# .env (in minutes) — example: 2 hours
SESSION_LIFETIME=120

For login pages that often sit idle, this is a very common cause.

4. Incorrect SESSION_DOMAIN / APP_URL Configuration

If the session cookie is not stored correctly (for example because the site is accessed via both www and non-www, which are treated as different domains), the token will not match. Make sure your .env is consistent:

APP_URL=https://www.yourdomain.com
SESSION_DOMAIN=.yourdomain.com
SESSION_SECURE_COOKIE=true

The leading dot on the domain (.yourdomain.com) makes the cookie valid for all subdomains.

5. APP_KEY Is Empty or Has Changed

Laravel uses APP_KEY to encrypt sessions and cookies. If the key is empty or changes, all old sessions become invalid. Regenerate it if needed:

php artisan key:generate

Note: changing the APP_KEY will log out every currently active user.

6. Configuration Cached After Being Changed

If you just changed your .env or a config file but the error persists, the old config is probably still cached. Clear it with:

php artisan config:clear
php artisan cache:clear
php artisan route:clear
php artisan view:clear

7. The storage Folder Is Not Writable (Permissions)

Session files are stored in storage/framework/sessions. If the server cannot write to this folder, the session fails to save and triggers a 419. Fix the folder permissions:

chmod -R 775 storage bootstrap/cache
chown -R www-data:www-data storage bootstrap/cache

(Adjust www-data to match your web server user, e.g. apache or your cPanel username.)

Quick Checklist

• Is @csrf present in every POST form?
• Do AJAX requests send the X-CSRF-TOKEN header?
• Is SESSION_LIFETIME long enough?
• Are APP_URL & SESSION_DOMAIN consistent?
• Is APP_KEY set?
• Did you run config:clear after changing .env?
• Is the storage folder writable?

Conclusion

The 419 Page Expired error in Laravel is 90% of the time caused by a missing CSRF token or a session problem. Start with the most common one — make sure @csrf is in your form — then work down to session configuration and permissions. With the checklist above, this error is usually solved in a matter of minutes.

Still have a stubborn 419 case? Drop it in the comments, and include a snippet of your form or AJAX request.