419 | Page Expired (CSRF token expired)

[stephenmeehanuk]

Bug description

When I try to login using Chrome, I see a 419 | Page Expired page. If I press back, I'm logged in?

• Clear all cookies and cache in Google Chrome
• Visit /cp/auth/login
• Enter login details, press login
• 419 | Page Expired
• Press refresh, nothing
• Press back, logged in?
• Log out, returns to /cp/auth/login
• Try to login again
• 419 | Page Expired
• Press back, /cp loads

On my staging site (https) I'm using STATAMIC_STATIC_CACHING_STRATEGY=half.
Someone in Discord suggested using SESSION_SECURE_COOKIE=true which I've done.

I've cleared the browser cache, and done a hard reload.

But it keeps on showing a 419 | Page Expired message.

It also happens on local (valet) http site. Not using SESSION_SECURE_COOKIE=truelocally.

How to reproduce

I think the issue is local to my browser, as it's not a problem when using incognito mode or Edge. It's happening in all browsers and in incognito mode in Chrome.

Just wondering why this would be happening?

Logs

No response

Environment

Environment
Application Name: 
Laravel Version: 10.48.10
PHP Version: 8.2.17
Composer Version: 2.7.4
Environment: staging
Debug Mode: OFF
URL: staging.website.com
Maintenance Mode: OFF

Cache
Config: CACHED
Events: NOT CACHED
Routes: CACHED
Views: CACHED

Drivers
Broadcasting: pusher
Cache: redis
Database: mysql
Logs: stack / single
Mail: smtp
Queue: redis
Session: redis

Livewire
Livewire: v3.4.11

Statamic
Addons: 6
Antlers: runtime
Sites: 1
Stache Watcher: Disabled
Static Caching: half
Version: 4.57.2 PRO

Statamic Addons
jacksleight/statamic-bard-mutator: 2.3.0
jonassiewertsen/statamic-jobs: 1.4.0
jonassiewertsen/statamic-live-search: 2.0.1
jonassiewertsen/statamic-livewire: 3.2.0
statamic/collaboration: 0.8.1
teamnovu/statamic-images-missing-alt: 1.0.2

Installation

Fresh statamic/statamic site via CLI

Antlers Parser

Runtime (default)

Additional details

No response

[duncanmcclean]

I've moved this into a discussion since it's likely a configuration issue, rather than a bug in Statamic itself.

Can you try switching the session driver to file? Also, what do you have SESSION_LIFETIME set to in your .env?

[duncanmcclean]

That's so weird. Which browser are you using? Have you tried clearing your browser cache & cookies?

[stephenmeehanuk]

I know? I've cleared browser cache & cookies multiple times. I'll keep an eye on it, try and figure out (if I can) what triggers it. It's odd that sometimes I can press back and I'm logged into the /cp.

[duncanmcclean]

I'm guessing it works fine if you use a completely different browser?

[stephenmeehanuk]

Yup, works fine in: Safari, Chrome (Canary), Edge, Opera

Just Chrome?!

[duncanmcclean]

Very weird - sounds like it could be some kind of Chrome issue (maybe?) but weird that it'd work fine in incognito 🤷‍♂️

[stuartcusackie]

I'm seeing this happen too when using full measure static caching.

I am a blade developer. Could this be a blade thing? I tried moving my csrf tag to the @nocache directive but that didn't solve it.

I also tried doing a replacement with custom javascript, but the page has already expired by the time the script runs.

The only thing that works is to exclude 'livewire/*' in the VerifyCsrfToken Middleware, which I don't like doing.

[aerni]

So you're using Livewire on that page then? There are a couple of PR's trying to make this experience better.
#10306 #10898 #11014.

Make sure you're on the latest Statamic version.

[stuartcusackie]

I am indeed using Livewire on the expired pages.

Those solutions look good. It's a tricky problem I see! I'll keep my eye on those. Thank you!

[stefanbauer]

I see the same as well in the latest version of statamic. I'm not able to log in via Chrome. Also got a 419 Session expired. Doesn't matter what I try. Incognito and all other browsers are working fine. Basically the same settings as the thread creator.

[MrMooky]

Same issue for me in Safari.

[MrMooky]

@duncanmcclean I guess it's not the same issue as stated by Stephen and others, but when using L11 or L12 with SESSION_DRIVER=database, I get a CSRF error during login. When I check the "Remember me" box during login, I can login, but essentially any POST method then throws the CSRF error.

[macaws]

Similar issue on our side - SESSSION_DRIVER=databse and CMS users are randomly hitting a wall where they cannot do anything without getting CSRF error.

Have you found a solution yet?

[jasonvarga]

Are you using 1Password or some other password manager?

Try to log in without using its autofill feature. Or, use a browser that doesn't have the extension installed. Does it still give you the 419 error?

I've noticed this issue on a number of sites - not just Statamic ones.

[MrMooky]

1Password is deactivated for local domains in my case, so that is not the issue. In my case, it's definitely an issue with the SESSION_DRIVER=database setting. It works just fine when using file instead.

[duncanmcclean]

If you're storing sessions in the database, can you try changing the user_id column from a varchar to an integer to see if that helps?

[MrMooky]

I don't want to cause a "THEN WHY DO YOU BOTHER US WITH THAT?!" response, but I don't plan to use the database driver. It's the new Laravel default it seems and it causes an issue out of the box when installing Statamic into an existing Laravel app. I didn't notice it was the issue in my case as I usually don't bother to change the defaults much in local development.

[duncanmcclean]

We still need to update the docs, but essentially it's happening because the default sessions migration expects your user IDs to be integers (which they are in a standard Laravel app), but Statamic uses UUIDs/strings for its user IDs.

We still use the file session driver by default on new Statamic sites.

Anyways, I'll try and get the docs updated this week. 👍

[JohnnyWalkerDigital]

Chrome issue

Despite what everyone is saying here, I'm having this issue with SESSION_DRIVER=file and SESSION_DRIVER=database. Note that this is only in CHROME. (Safari works fine -- bewildering.)

It's very confusing.

Clearing site data does nothing, but trying incognito mode allows you to log in. However even after you're logged in you can't make any changes because you'll get a CSRF mismatch error.

Things I've tried:

1. Set SESSION_DRIVER=database
2. Publish the session table migration with php artisan make:session-table but changing user_id to string 255
3. Run migration to create the new sessions table

Same issue.

And:

1. Setting SESSION_DRIVER=file

Exactly same behaviour.

Again: This is only in Chrome.

[stefanbauer]

Yes 👍

[duncanmcclean]

What is SESSION_LIFETIME set to in your .env?

[stefanbauer]

Default. It's a naked, brand new Statamic installation. So 120.

[JohnnyWalkerDigital]

And you're both on the latest version of Statamic, yes?

Yes. 5.50.0

I have disabled all my Chrome extensions, too.

What is SESSION_LIFETIME set to in your .env?

120

[macaws]

We're having the same issue - DB sessions as well