Laravel: 419 Page Expired

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# The token has to be in the form, and in a meta tag for fetch calls
<form method="POST">@csrf</form>
<meta name="csrf-token" content="{{ csrf_token() }}">

# Is a session actually being written?
php artisan tinker --execute="session(['a'=>1]); dump(session()->getId());"
ls -la storage/framework/sessions | tail

# .env: the cookie must match the host the browser sees
SESSION_DRIVER=redis
SESSION_DOMAIN=.example.com
SESSION_SECURE_COOKIE=true

# Config cached from a previous deploy is a classic cause
php artisan config:clear && php artisan config:cache

# A page cached by a CDN serves everybody the same stale token

How to diagnose PHP errors

PHP errors are dominated by per-request resource limits (memory_limit, max_execution_time) and by autoloading. Class-not-found errors are almost never missing code. They are a namespace that does not match the PSR-4 mapping, or a stale Composer autoload map. Laravel adds a caching layer that produces genuinely confusing errors when configuration is cached with the wrong environment.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Read the real limits from the running process, not from a config file: php -i | grep -E 'memory_limit|max_execution_time'. CLI and FPM have separate configurations.
2. Regenerate the autoload map with composer dump-autoload -o before investigating a class-not-found error any further.
3. For Laravel, clear cached config and routes with php artisan optimize:clear. A config cache built in the wrong environment causes errors that survive every code change.
4. Enable full error display in development (display_errors=On, error_reporting=E_ALL). The default production settings hide the cause.
5. For PDO connection refusals, test the same credentials with the database's own CLI client to separate PHP configuration from database access.

Tools worth reaching for

• php -i
• composer dump-autoload -o
• php artisan optimize:clear
• Xdebug
• tail -f storage/logs/laravel.log

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 laravel.com

Related PHP errors

• Allowed memory size exhaustedThe PHP script exceeded the configured memory_limit. Usually caused by loading large…
• Class 'X' not foundPHP cannot find the specified class. Usually caused by a missing use statement, incorrect…
• Laravel: Target class [X] does not existLaravel container cannot resolve the class. Usually due to missing 'use' statement, typo, or…
• Maximum execution time exceededThe PHP script ran longer than the max_execution_time setting allows. Default is usually 30…
• PHP 8.4: Implicitly marking parameter as nullable is deprecatedDeclaring a typed parameter with a null default used to imply a nullable type. PHP 8.4…
• PHP-FPM: server reached pm.max_children setting, consider raising itEvery worker in the pool is busy, so new requests sit in the listen backlog until Nginx gives…
• PHP: Fatal error: Call to a member function x() on nullA method was called on a variable holding null, which PHP 8 treats as a fatal Error rather…
• SQLSTATE[HY000]: Connection refusedPDO cannot connect to the database server. The database may be down, credentials wrong, or…

See all 11 PHP errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.