CSRF Token Mismatch Laravel 4

Question

This is driving me crazy. I'm getting token mismatches on each POST whether from a Laravel form or from AJAX. I added some code to the filter to show me the session vs. _token:

Route::filter('csrf', function()
{
if ($_SERVER['REQUEST_METHOD'] !== 'GET') {

    $token = Input::has('_token') ? Input::get('_token') : '';
    $sessionToken = Session::token();

    if ($sessionToken != $token)
    {
        $message = 'Token mismatch';

        // This one is for debug purposes only
        return Response::json(['flash' => "$message; session: $sessionToken ; yours : $token"], 401);

        return Response::json(['flash' => $message], 401);
    }
  }
  });

Here's the login form:

        {{ Form::open(array('route' => 'sessions.store')) }}

        <div class="form-group">
            {{ Form::label('email', 'Email Address') }}
            {{ Form::text('email', '', array('placeholder' => '[email protected]', 'class' => 'form-control')) }}
        </div>

        <div class="form-group">
            {{ Form::label('password', 'Password') }}
            {{ Form::password('password', array('placeholder' => 'Enter your password', 'class'=>'form-control')) }}
        </div>

        <div class="form-group">
            {{ Form::submit('Sign in', array('class' => 'btn login'))}}

            <a href="{{{ URL::to('session/registration') }}}" class="btn signup">Create an Account</a>
        </div>

    {{ Form::close() }}

For example when logging in, here is the token mismatch flash I get:

{"flash":"Token mismatch; session: uN3sd8PNWUfgTuqc1RZrRfXgpGpHOEKkCtoo3XVX ; yours : Ybmn6u80rLpxIcGdahd7KT2eR6WmcaPN28arZ9kg"}

It's happening when I have app/config/session.php set to 'apc'. All is fine when it's set to 'native' or 'cookie'. I have cache set to 'apc', which is our caching engine on our server.

Ideas?

Hi. Did you ever find a solution for this? This only happen when I try to access the website in other computers. — Anna Fortuna
– Anna Fortuna, Commented Jan 25, 2014 at 6:33
Strange thing happen with me, I just clear the chrome cache and it works now. — SSR
– SSR, Commented Mar 17, 2016 at 6:28

tharumax · Accepted Answer · 2013-11-21 22:10:29Z

2

You are not submitting _token with your POST request.

Add

  <input type="hidden" name="_token" value="<?php echo csrf_token(); ?>"

before {{Form::close()}}

http://laravel.com/docs/security#protecting-routes

answered Nov 21, 2013 at 22:10

tharumax

1,2619 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

julie-coderiver Over a year ago

It actually gets added automatically with Laravel 4 and is present in the DOM.

Captain Hypertext Over a year ago

This actually solved my problem. I didn't event think to include the form token in my ajax request.

flux · Accepted Answer · 2014-03-16 12:41:36Z

0

I had that problem too, I don't know the actual way to fix this. I think this is a bug, but I needed my application to function. So here's the original app/filter.php file:

Route::filter('csrf', function() {
    if (Session::token() != Input::get('_token'))
        throw new Illuminate\Session\TokenMismatchException;
    }
});

I modified it to use the csrf_token() function and it worked for me,

Route::filter('csrf', function() {
    if (csrf_token() != Input::get('_token')) {
        throw new Illuminate\Session\TokenMismatchException;
    }
});

This is just a quick fix to get my application up and working before someone figures out a solution.

answered Mar 16, 2014 at 12:41

flux

1937 bronze badges

1 Comment

Benubird Over a year ago

That doesn't make sense, because csrf_token() just returns Session::token()

Pierlo Upitup · Accepted Answer · 2014-05-20 12:30:18Z

0

Are your sessions being saved to the DB? In my case they weren't. AndreasLutro from the #laravel IRC suggested to check this issue out! https://github.com/laravel/framework/issues/4441

answered May 20, 2014 at 12:30

Pierlo Upitup

1,6124 gold badges19 silver badges27 bronze badges

Comments

Dream Ideation · Accepted Answer · 2014-10-06 15:02:51Z

0

I ran into this issue on my local computer. I have Laravel running on a web server and the csrf token is working great, but not on my local computer.

I have cache set to file on my local computer.

I found out that sessions were not getting saved. I fixed this by changing the permissions for the "storage/sessions" folder on my local machine (not the server!) to 777.

answered Oct 6, 2014 at 15:02

Dream Ideation

1531 silver badge6 bronze badges

Collectives™ on Stack Overflow

CSRF Token Mismatch Laravel 4

4 Answers 4

2 Comments

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related