Laravel VerifyCsrfToken.php line 53 random on posts - ajax

Question

I'm getting an 500 error from server randomly with some (not all!) post requests. After that error, I have to login.
I implemented PDF2HtmlEX that create html pages made with elements and resources like web fonts.
To change page I make a post and get the data but after some page (not always the same) the ajax post return 500 and inside the data (and the log) I see the error:
[2015-12-21 22:17:48] local.ERROR: exception 'Illuminate\Session\TokenMismatchException' in /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php:53
Stack trace:
#0 [internal function]: Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle(Object(Illuminate\Http\Request), Object(Closure))
#1 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(124): call_user_func_array(Array, Array)
#2 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#3 [internal function]: Illuminate\View\Middleware\ShareErrorsFromSession->handle(Object(Illuminate\Http\Request), Object(Closure))
#4 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(124): call_user_func_array(Array, Array)
#5 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(62): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#6 [internal function]: Illuminate\Session\Middleware\StartSession->handle(Object(Illuminate\Http\Request), Object(Closure))
#7 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(124): call_user_func_array(Array, Array)
#8 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#9 [internal function]: Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle(Object(Illuminate\Http\Request), Object(Closure))
#10 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(124): call_user_func_array(Array, Array)
#11 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(59): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#12 [internal function]: Illuminate\Cookie\Middleware\EncryptCookies->handle(Object(Illuminate\Http\Request), Object(Closure))
#13 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(124): call_user_func_array(Array, Array)
#14 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(44): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#15 [internal function]: Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode->handle(Object(Illuminate\Http\Request), Object(Closure))
#16 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(124): call_user_func_array(Array, Array)
#17 [internal function]: Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#18 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(103): call_user_func(Object(Closure), Object(Illuminate\Http\Request))
#19 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(122): Illuminate\Pipeline\Pipeline->then(Object(Closure))
#20 /path/to/laravel-project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(87): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter(Object(Illuminate\Http\Request))
#21 /path/to/laravel-project/public/index.php(54): Illuminate\Foundation\Http\Kernel->handle(Object(Illuminate\Http\Request))
#22 {main}
Like explaned in the documentation, I add...
<meta name="csrf-token" content="{{ csrf_token() }}">
in the app.blade.php master view templates.
And at the start of js script I add:
$.ajaxSetup({
headers: {
'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
}
});
I googled a lot and searched inside stackoverflow but I can't figure it out!
The problem is that the error is occurring somethimes, not always: seems like there is a limit of checks that the token is considered valid.
I use ajax, so the meta tag with token never change across posts.
I'm using laravel 5.1 (5.0 upgraded).
EDIT 1:
I tried to increase 'lifetime' => 120, value inside project/config/session.php: if the value is low (tried 10) I can get this error on 2nd or 3rd post (after 10-20 secs), if the value is hight (tried 9999) I get this error on 30th+ post requests (after 4-5 minutes).
EDIT 2:
I add some log inside the controller and middleware.
I can see all the get requests return correct values, the post error, the other get files started after the post that have the same token inside the ajax header of the post.
I can't see the log of the method of controller that serve post request:
routes.php:
Route::post('/page', "RController#rPageData");
RController.php:
public function rPageData(){
Log::info("I am there!"); # always showed except when error occurred.
# ... other code ...
}
EDIT 3:
More infos: I dumped out $request from a correct post in RController::rPageData(), and a error post request from the Exception handler.
I see that the first 2 lines, userResolver and routeResolver, are null in error post, and well done in correct post. Seems like user is not authenticated, but the nexts GET request, like reported in my EDIT 2, are made correctly.
Error post:
Request {#40 ▼
#json: null
#userResolver: null
#routeResolver: null
...
Good post:
Request {#40 ▼
#json: null
#userResolver: Closure {#144 ▶}
#routeResolver: Closure {#154 ▶}
...
Inside the Request > cookies > headers > parameters > XSRF-TOKEN I have the same token in the 2 posts.
Inside the Request > session > attributes > _token, I have 2 different token in the 2 posts.
EDIT 4:
Well, if you put session_start(); at the top of your routes.php, after <?php tag, it will work.
NOTE: this is not the solution. GrahamCampbell (the second biggest Laravel contributor) said:
NEVER do that! Because that's totally incorrect.
Attach reference
Have you any suggestions?
Thank you in advance!

Answer 1

By default, sessions last 2 hours in Laravel. When they begin to fail have you refreshed the page within 2 hours?
You can increase the length of time sessions will be valid for in config/session.php:
'lifetime' => 120 //120 minutes is 2 hours