419 Page Expired error on every network request. | Laravel | Page 1

icy arrow Jul 31, 2023, 2:15 AM

#

My Laravel project was running completely fine and then I had to re setup the project in my laptop so I deleted the project directory and cloned the project in a new directory. After that I get 419 page expired error on every network request. It is showing that error in the network tab when any Livewire network request is triggered and also on any form submission eg. login form.

The project is running completely fine on other devices as I have asked my colleague to test it on their devices but only showing error on my device. I have resetup the project in completely new directory as well.

I have a Mac Book, with Laravel Herd recently added. The project is on Laravel 10 and also has Livewire.

I hope this clears my problem, please ask me if you want more details that I have missed out.

next crown Jul 31, 2023, 5:07 AM

#

The best I can say with the info provided is you are somehow missing a csrf token in the request

icy arrow Jul 31, 2023, 5:20 AM

#

next crown The best I can say with the info provided is you are somehow missing a csrf toke...

That was my first diagnosis as well but I checked the main layout page has a meta tag for CSRF in case of livewire and a @bronze steppe for the login form.

final wasp Jul 31, 2023, 5:49 AM

#

Att you allowing cookies on http (non-https)?

fickle lagoon Jul 31, 2023, 6:27 AM

#

ENV setup correctly? Like session driver.. Did you clear cache/config? (time on your macbook is correct?)

icy arrow Jul 31, 2023, 6:27 AM

#

final wasp Att you allowing cookies on http (non-https)?

I am sorry I am not really sure how would I check that, but I have done nothing related to Cookies at this point and its default laravel with the larastarted admin panel. So, it should be what ever it defaults too.

icy arrow Jul 31, 2023, 6:28 AM

#

fickle lagoon ENV setup correctly? Like session driver.. Did you clear cache/config? (time on...

yes, I have gone through optimization and cache clears, and also have checked the .env to be properly correct.

final wasp Jul 31, 2023, 6:29 AM

#

Check the headers tab in the image above, there may be an orange warning icon next to the cookies

#

Hover that go get more info

#

And look in session.php regarding the secure setting

icy arrow Jul 31, 2023, 6:36 AM

#

There is no warning sign in the headers tab of the webpage, it says one cookies in use.

And the secure setting is on default.

final wasp Jul 31, 2023, 7:04 AM

#

You need it disabled to use http

icy arrow Jul 31, 2023, 10:44 AM

#

Even doing that didn’t solve the issue.

sacred ice Jul 31, 2023, 11:28 AM

#

icy arrow That was my first diagnosis as well but I checked the main layout page has a met...

How are you submitting this form?

icy arrow Jul 31, 2023, 11:29 AM

#

This is the network request through wire:model when I change the value of select option.

sacred ice Jul 31, 2023, 11:30 AM

#

Alright, so I think you should remove the meta tag. I'd assume Livewire takes the csrf token from the cookie (as an SPA would), but the meta tag might mess with that

#

Hmm, looking at Jetstream it also has the meta tag. Didn't expect that tbh, don't use Livewire myself, so it was just a guess

icy arrow Jul 31, 2023, 11:31 AM

#

But, my admin login which is not supported by the Livewire/or in the same layout, shouldn’t be affected by this problem I suppose. But Even with the login there is same 419 error

sacred ice Jul 31, 2023, 11:32 AM

#

Then it sounds like a session issue, where you're getting a fresh session each request, thus the token doesn't match

icy arrow Aug 1, 2023, 3:14 AM

#

sacred ice Then it sounds like a session issue, where you're getting a fresh session each r...

Whenever I change hit a network request or refresh the page a session is being generated here. Does this confirm that it's the issue you are stating? I am not sure how to fix this or how this can occur.

sacred ice Aug 1, 2023, 8:33 AM

#

Yeah, that seems like the session doesn't persist. Is the session cookie being blocked?

icy arrow Aug 1, 2023, 8:45 AM

#

It doesn't seem to be blocked from anywhere. Do tell me if there is any specific place I should look.

final wasp Aug 1, 2023, 7:24 PM

#

I still think the chrome dev tools will tell you why a cookie is not “sticking”, with an orange exclamation point icon in the “response headers” section. Hover on that to get the reason. Did you try to run the site locally with https (valet secure if you’re using valet)?

icy arrow Aug 3, 2023, 2:55 AM

#

If this is what you mean, I do not see any Exclamation Marks, the one of the top right is giving a warning of "Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'browsing-topics'." which is new and had not seen this before. I am sorry if I am not understanding what you are trying to convey.

icy arrow Aug 4, 2023, 10:29 AM

#

I see there is no data stored in here where in fact the XSRF token and session value should hav been stored. But I cannot find any way how it can be blocked to store it.

sacred ice Aug 4, 2023, 10:31 AM

#

Your page has no cookies at all, by the looks of it, not even a session cookie. So perhaps it's just your browser that's preventing all cookies, which would make any site rather unusable

icy arrow Aug 4, 2023, 10:32 AM

#

But, other sites are usable and the problem exists in other browsers as well. Do you think this might be a issue of config?

wicked knoll Aug 4, 2023, 12:07 PM

#

I had this happen yesterday in production and as far as I could tell it was caused by high resource usage of the database (mysql) once resource usage went back to normal the error stopped. There weren't any connection errors reported though which is what made it so odd

icy arrow Aug 4, 2023, 3:22 PM

#

Well in my condition, the session doesnt seem to be stored in cookies, it just sends new one everytime and since it doesnt match it sends back the 419 error. I am not sure what to do now. Been stuck in this for a while, cannot even explain the situation to the client.

loud snow Aug 4, 2023, 3:28 PM

#

@icy arrow is there anything in the session storage? Have you commented/removed any core middleware?

icy arrow Aug 4, 2023, 3:31 PM

#

No, I have not removed any middleware, the project runs fine on other devices so I believe there is not problem with that..

If you mean the storage/framework/session there are multiple sessions being created on each network request or page refresh.

loud snow Aug 4, 2023, 3:31 PM

#

I mean 'Session Storage' in the network tab

loud snow Aug 4, 2023, 3:33 PM

#

icy arrow No, I have not removed any middleware, the project runs fine on other devices so...

It's fine on other devices? do you have any software (since you said other browsers are affected) that would prevent this data being stored.

icy arrow Aug 4, 2023, 3:35 PM

#

loud snow I mean 'Session Storage' in the network tab

it appears to be empty too

icy arrow Aug 4, 2023, 3:36 PM

#

loud snow It's fine on other devices? do you have any software (since you said other brows...

I do not have anything that would block that in my mind, everything was running properly but since there was a lot of changes in branches I wanted to resetup the project on my laptop and after that it stopped working.

Only thing new in my setup would be Larvel Herd.

loud snow Aug 4, 2023, 3:36 PM

#

AddQueuedCookiesToResponse middleware is responsible for setting those cookies. If you're saying it works on other devices then it must be something with your device that's causing the issue.

final wasp Aug 4, 2023, 3:42 PM

#

Can you show an image of the network tab response headers section, are there really no cookies there?

icy arrow Aug 4, 2023, 4:13 PM

#

final wasp Can you show an image of the network tab response headers section, are there rea...

is this what you mean?

final wasp Aug 4, 2023, 4:16 PM

#

Is that request the page navigation? The hash in the url is suspicious, are you using some form of spa-routing?

icy arrow Aug 5, 2023, 5:13 AM

#

No, the hash on the url is a mistake.

icy arrow Aug 29, 2023, 3:13 AM

#

Hi, people while the issue still hadn't been fixed, I couldn't figure out what to do and went on continuing with the development by disabling the CSRF checks and authentications on the local machine. The project was working properly in the staging website so I didn't think of it much and went on with the development. Today I deployed it to the production server and the same issue has repeated in the production server as well.

Can you please find what I was missing through this http://bhojanunlimited.com/

It would be a big help since the client is waiting for the website and it is still throwing errors.

Thank you

final wasp Aug 29, 2023, 6:26 AM

#

There are no cookies whatsoever. So either you have excluded the StartSession middleware, but probably not since it works locally. If that's not it, perhaps you have a proxy that removes cookies? Check the hosting provider if there is a "allow cookies" toggle

#

You should also configure "force https"

icy arrow Aug 29, 2023, 7:04 AM

#

It also doesn't work locally, but works on a staging server. But I will check for the allow cookeis toggle in the production hosting server

final wasp Aug 29, 2023, 7:53 AM

#

Why would you put anything into production, or even a staging server, if it doesn't work locally?

icy arrow Aug 29, 2023, 8:24 AM

#

No no, it was all working properly, I tested it and after it was working properly in my local computer, I pushed to staging/testing server. I had changed my admin dashboard from filament to laraadmin, so the repository were a bit messed up I fixed the repository and thought I would clean up my local project and reclone it form git.

After cloning from git again the project stopped working in my local, but it was properly working in the staging server. So I though the issue was with my local computer. I disabled the VerifyCSRF middleware and did some fixes and changes.

After that I proceeded to setup the production server since this was a new project, and I didn't think the issue will repeat there ( since the project was also running in other devices and also the staging server). But the same issue is there in the production server too.

I hope you got what I meant sorry for the poor english.

final wasp Aug 29, 2023, 8:35 AM

#

Your english is great!

#

I understand – but if it's not working locally, focus on fixing that before worrying about production

icy arrow Aug 29, 2023, 10:22 AM

#

Ok, what would be my next step of action becasuse I have checked a whole lot of possible solutions and ideas.

icy arrow Aug 29, 2023, 10:59 AM

#

Hey @final wasp I seemed to have solved the issue.

There was a line before the "<?php" in the web.php file. I removed that space and now it seems to be working.

I have no clue how this is possible, since that same project was cloned into other devices and it was working there. I removed the same in the production server too now and its working there too.

final wasp Aug 29, 2023, 11:03 AM

#

Great find! That would indeed prevent headers from being set, but that should also show as warnings in php logs

icy arrow Aug 29, 2023, 11:17 AM

#

There was no logs set for that error, I do not understand how a blank space would affect this can you please explain if you have idea about it

final wasp Aug 29, 2023, 11:22 AM

#

See the “Remember that…” section here. Cookies are set in a header, and headers must come before any output

#

https://www.php.net/manual/en/function.header.php

#

Very hard to miss and almost impossible to track down such errors.

#

And, any content (including whitespace) outside php tags counts as output. That’s also why it’s good practice to not end php files with a closing tag

icy arrow Aug 29, 2023, 11:25 AM

#

I see, thats great. Thank you so much for the help and valuable insights! @final wasp

#419 Page Expired error on every network request.