419 Page Expired

Laravel: the CSRF token is missing or invalid, usually because the session expired.

419 at a glance

Code: 419
Name: Page Expired
Class: 4xx Client error
Status: Non-standard used by Laravel
Documented by: Laravel
Cacheable by default: No by default. Caches only store responses with unrecognised status codes if explicit freshness (Cache-Control max-age) is given.

What 419 means

Laravel returns 419 "Page Expired" when its VerifyCsrfToken middleware rejects a POST, PUT, PATCH or DELETE: the request had no CSRF token, or the token does not match the one in the user's session. Most often the session expired while a form was open, or the session cookie was never stored.

What typically causes a 419

A form without the @csrf Blade directive.
AJAX or fetch requests without the X-CSRF-TOKEN (or X-XSRF-TOKEN) header.
Session expired (SESSION_LIFETIME) while the page was open.
Session cookie not saved: wrong SESSION_DOMAIN, SESSION_SECURE_COOKIE=true over plain HTTP, or a full/unwritable session store.

Fix it on the server

Add @csrf to forms and send the token from <meta name="csrf-token"> in JS requests.
Check SESSION_DOMAIN, SESSION_SECURE_COOKIE and the session driver; behind a proxy, configure TrustProxies so HTTPS is detected.
Exclude genuine webhooks (Stripe, GitHub) from CSRF in the middleware config.

Fix it as a client or visitor

Reload the page to get a fresh token and submit again; make sure cookies are enabled.

Headers that go with 419

Header	Role
`X-CSRF-TOKEN`	Header Laravel reads the token from on AJAX requests.
`Set-Cookie`	XSRF-TOKEN and the session cookie.

Example response

HTTP/1.1 419 unknown status
Content-Type: text/html; charset=UTF-8

<title>Page Expired</title>