How does CSRF protection work in Laravel, what causes a 419 Page Expired error, and how do you fix it?

Short answer

Laravel generates a unique CSRF token per session and checks it on every POST/PUT/DELETE request; status 419 means the session expired or the form did not include the token.

Explanation

The ValidateCsrfToken Middleware (called VerifyCsrfToken before Laravel 11) generates a token and stores it in the session. Blade templates include it with @csrf. On a state-changing request, Laravel compares the submitted token with the session token and returns 419 if they differ or the session has expired. API endpoints using Bearer Tokens belong in routes/api.php, where this check is not applied.

Code example

<form method="POST" action="/profile">
    @csrf
    <input type="text" name="name">
</form>

Common mistakes

• Adding sensitive Web routes to the CSRF exclusion list (validateCsrfTokens(except: [...]) in Laravel 11+ or $except in earlier versions) to disable protection instead of fixing session renewal.

Follow-up questions

• How do you implement a Content Security Policy with a Nonce in Laravel applications?

Sources

• Laravel docs — CSRF Protection