CODEWITHSUNDEEP
laravel-4
julie-coderiver
julie-coderiver

Reputation: 1119

CSRF Token Mismatch Laravel 4

This is driving me crazy. I'm getting token mismatches on each POST whether from a Laravel form or from AJAX. I added some code to the filter to show me the session vs. _token:

Route::filter('csrf', function()
{
if ($_SERVER['REQUEST_METHOD'] !== 'GET') {

    $token = Input::has('_token') ? Input::get('_token') : '';
    $sessionToken = Session::token();

    if ($sessionToken != $token)
    {
        $message = 'Token mismatch';

        // This one is for debug purposes only
        return Response::json(['flash' => "$message; session: $sessionToken ; yours : $token"], 401);

        return Response::json(['flash' => $message], 401);
    }
  }
  });

Here's the login form:

        {{ Form::open(array('route' => 'sessions.store')) }}

        <div class="form-group">
            {{ Form::label('email', 'Email Address') }}
            {{ Form::text('email', '', array('placeholder' => '[email protected]', 'class' => 'form-control')) }}
        </div>

        <div class="form-group">
            {{ Form::label('password', 'Password') }}
            {{ Form::password('password', array('placeholder' => 'Enter your password', 'class'=>'form-control')) }}
        </div>

        <div class="form-group">
            {{ Form::submit('Sign in', array('class' => 'btn login'))}}

            <a href="{{{ URL::to('session/registration') }}}" class="btn signup">Create an Account</a>
        </div>

    {{ Form::close() }}

For example when logging in, here is the token mismatch flash I get:

{"flash":"Token mismatch; session: uN3sd8PNWUfgTuqc1RZrRfXgpGpHOEKkCtoo3XVX ; yours : Ybmn6u80rLpxIcGdahd7KT2eR6WmcaPN28arZ9kg"}

It's happening when I have app/config/session.php set to 'apc'. All is fine when it's set to 'native' or 'cookie'. I have cache set to 'apc', which is our caching engine on our server.

Ideas?

Upvotes: 2

Views: 9622

Answers (4)

Dream Ideation
Dream Ideation

Reputation: 153

I ran into this issue on my local computer. I have Laravel running on a web server and the csrf token is working great, but not on my local computer.

I have cache set to file on my local computer.

I found out that sessions were not getting saved. I fixed this by changing the permissions for the "storage/sessions" folder on my local machine (not the server!) to 777.

Upvotes: 0

Pierlo Upitup
Pierlo Upitup

Reputation: 1612

Are your sessions being saved to the DB? In my case they weren't. AndreasLutro from the #laravel IRC suggested to check this issue out! https://github.com/laravel/framework/issues/4441

Upvotes: 0

flux
flux

Reputation: 193

I had that problem too, I don't know the actual way to fix this. I think this is a bug, but I needed my application to function. So here's the original app/filter.php file:

Route::filter('csrf', function() {
    if (Session::token() != Input::get('_token'))
        throw new Illuminate\Session\TokenMismatchException;
    }
});

I modified it to use the csrf_token() function and it worked for me,

Route::filter('csrf', function() {
    if (csrf_token() != Input::get('_token')) {
        throw new Illuminate\Session\TokenMismatchException;
    }
});

This is just a quick fix to get my application up and working before someone figures out a solution.

Upvotes: 0

tharumax
tharumax

Reputation: 1261

You are not submitting _token with your POST request.

Add 

  <input type="hidden" name="_token" value="<?php echo csrf_token(); ?>"

before {{Form::close()}}

http://laravel.com/docs/security#protecting-routes

Upvotes: 2

Related Questions