Skip to content

419 Page Expired

Laravel's code for a missing or expired CSRF token, most often seen when a form is submitted after the session lapsed.

Status

HTTP/1.1 419 Page Expired

Details

  • Category: 4xx
  • Status: Unofficial (Laravel). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

Laravel's VerifyCsrfToken middleware rejects requests whose CSRF token is absent, stale, or does not match the session, and it uses 419 rather than the more conventional 403. The user-visible symptom is a form that fails on submit after the page has been open for a while.

Since it is not a registered code, nothing outside the Laravel ecosystem interprets it. Treat it as a session or token problem specific to that framework.

Common causes

  • The session expired while a form sat open, invalidating its CSRF token.
  • The _token field was missing from the submitted form or the X-CSRF-TOKEN header from an AJAX request.
  • Session cookies blocked, or a session driver problem such as an unreachable cache backend.
  • Mismatched APP_KEY or session domain across servers behind a load balancer.

How to fix it

As the client

  • Reload the page to pick up a fresh token and resubmit.
  • For AJAX, send the token in X-CSRF-TOKEN, read from the csrf-token meta tag.
  • Check that cookies are enabled and that the session cookie domain matches the site.

As the server

  • Extend the session lifetime, or refresh the token in the background on long-lived pages.
  • Share the session store and APP_KEY across all application servers.
  • Return a clear message rather than a bare 419 so users know to reload.

Examples

Submitting a form after the session expired

HTTP request

POST /profile HTTP/1.1
Host: app.example.com
Content-Type: application/x-www-form-urlencoded

name=Alex

HTTP response

HTTP/1.1 419 Page Expired

See also