I am developing stateless resful API application, so I do not need sessions at all.
I removed a line with \Illuminate\Session\Middleware\StartSession::class, from protected $middleware = []; in \app\Http\Kernel.php I have also removed SESSION_DRIVE from .env file. But I am getting following error:
RuntimeException in Request.php line 756: Session store not set on request.
How can I turn off sessions in Laravel 5?
Remove the Illuminate\Foundation\Http\Middleware\VerifyCsrfToken and Illuminate\View\Middleware\ShareErrorsFromSession classes from your middleware too. These features require sessions.
Not required but I'd also probably suggest setting your session driver to array, just so that if any features you are using require the sessions feature they can at least work without throwing errors. The array driver, as it suggests, stores all the session data in a standard PHP array so everything is erased as soon as the request is completed.
Related
I have multiple Laravel sites hosted on the same server. With the latest site I've created, the contact form refuses to submit without throwing a 419 error. I have set up the routing in my web.php file just like the other websites, which have live, working contact forms, and I'm generating and sending the token exactly the same way - with {{ csrf_field() }}.
I found an answer to a similar question stating that you can disable Csrf checking by adding entries to the $except array in app/Http/Middleware/VerifyCsrfToken.php. I have verified that this does indeed resolve the 419 error:
protected $except = [
'contact',
'contact*',
];
But of course I wish to keep the Csrf functionality, and I only updated the $except array for troubleshooting value.
Does anyone know what may be different about the new Laravel environment that would have this 419 behavior despite passing the generated token? I have tried updating a number of ENV settings and toggling different things, but nothing other than modifying the $except array has had any influence on the issue.
Update
Since there has been a bit of discussion so far, I figured I'd provide some additional info and code.
First, this is an ajax form, but don't jump out of your seat just yet. I have been testing the form both with and without ajax. If I want to test with ajax, I just click the button that's hooked up to the jQuery listener. If not, I change or remove the button's ID, or run $("#formName").submit(); in the console window.
The above (ajax, old-fashioned submit, and the jquery selector with .submit();) all result in the exact same response - a 419 error.
And for the sake of completeness, here's my ajax code which is working on all of the other websites I'm hosting. I define a postData array to keep it all tidy, and I added a console.log() statement directly after it to (again) confirm that token is generated just fine and is being passed correctly with the request.
var postData = {
name: $("#name").val(),
email: $("#email").val(),
message: $("#message").val(),
_token: $("input[name=_token]").val()
};
console.log(postData);
$.post("/contact", postData, function (data) {
...
Any ideas? Could there be a configuration issue with my ENV or another file?
Progress Update!
Because the other sites are working just fine, I cloned an old site and simply overwrote the files that I changed for the new website, and bam! It's working now. Doing a little bit more digging, I ran php artisan --version on the cloned version of the site versus the non-working version, and here are the results:
Working Version: Laravel Framework 5.7.3
Non-working Version: Laravel Framework 5.7.9
Perhaps this is a bug with Laravel? Or perhaps some packages on my server are out of date and need to be updated to work with the new version of Laravel?
TLDR: This post contains lots of potential issues and fixes; it is intended for those scouring for related bonus information when stuck.
I just encountered this error using Laravel Sanctum in what looks like improperly setup middleware. Sanctum uses the auth:sanctum middleware for the guard, which is some kind of extension of the auth guard of which Laravel uses as the default, but session is handled by the web middleware group.
I can't exactly verbalize some of this internal-Laravel stuff; I am more experienced with JavaScript than PHP at the moment.
In my api.php file, I had the login/register/logout routes, and in my Kernel.php file, I copied \Illuminate\Session\Middleware\StartSession::class, from the web group into the api group.
I had to do that to fix my login unit test that was throwing an error about "Session store not on request". Copying that allowed me my postJson request to work in the unit test, but sometime later, I started seeing 419 CSRF error posting from the JavaScript app (which is bad because it worked fine earlier).
I started chasing some filesystem permission red-herring in the /storage/framework/sessions folder, but the issue wasn't that (for me).
I later figured out that with Laravel Sanctum and the default AuthenticatesUsers trait, you must use the web guard for auth, and the auth:sanctum middleware for protected routes. I was trying to use the api guard for auth routes and that was central to my 419 errors with the AuthenticatesUsers trait.
If anyone gets 419 while CSRF was working or should work, I recommend doing some \Log::debug() investigations at all the key points in your system where you need these to work:
Auth::check()
Auth::user()
Auth::logout()
If you get strange behaviour with those, based on my observations, there is something wrong with your config related to sessions or something wrong with your config related to web, api guards.
The guards have bearing on the AuthManager guard which maintains state over multiple requests and over multiple unit tests.
This is the best description I found, which took over a week for me to discover:
Method Illuminate\Auth\RequestGuard::logout does not exist Laravel Passport
As a random final example, if your session is somehow generating the CSRF token using data from the web middleware group while your routes are set to use api, they may interpret the received CSRF incorrectly.
Besides that, open Chrome dev tools and goto the Applications tab, and look at the cookies. Make sure you have the XSRF-TOKEN cookie as unsecure (ie: not httpOnly).
That will allow you to have an Axios request interceptor such as this:
import Cookies from 'js-cookie';
axios.interceptors.request.use(async (request) => {
try {
const csrf = Cookies.get('XSRF-TOKEN');
request.withCredentials = true;
if (csrf) {
request.headers.common['XSRF-TOKEN'] = csrf;
}
return request;
} catch (err) {
throw new Error(`axios# Problem with request during pre-flight phase: ${err}.`);
}
});
That is how my current Laravel/Vue SPA is working successfully.
In the past, I also used this technique here:
app.blade.php (root layout file, document head)
<meta name="csrf-token" content="{{ csrf_token() }}">
bootstrap.js (or anywhere)
window.axios = require('axios');
window.axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';
const token = document.head.querySelector('meta[name="csrf-token"]');
if (token) {
window.axios.defaults.headers.common['X-CSRF-TOKEN'] = token.content;
} else {
console.error('CSRF token not found: https://laravel.com/docs/csrf#csrf-x-csrf-token');
}
In my opinion, most problems will stem from an incorrect value in one or more of these files:
./.env
./config/auth.php
./config/session.php
Pay close attention to stuff like SESSION_DOMAIN, SESSION_LIFETIME, and SESSION_DRIVER, and like I said, filesystem permissions.
Check your nginx access.log and/or error.log file; they might contain a hint.
just found your issue on the framework repo.
It is not a laravel issue, your installation is missing write permissions on the storage folder, thus laravel can't write session, logs, etc.
You get a 419 error because you can't write to the files, thus you can't create a sessionn, thus you can't verify the csrf token.
Quick fix: chmod -R 777 storage
Right fix: move your installation to a folder where nginx/apache/your user can actually write.
If you are using nginx/apache, move you app there and give the right permissions on the project (chown -R www-data: /path-to-project)
If you are using php artisan serve, change it's permissions to your user: chown -R $(whoami) /path-to-project
You get it, let writers write and you're good.
Probably your domain in browser address bar does not match domain key in config/session.php config file or SESSION_DOMAIN in your env file.
I had the same issue, but the problem in my case was https. The form was on http page, but the action was on https. As a result, the session is different, which is causing the csrf error.
run this command
php artisan key:generate
I used the same app name for staging and prod, being staging a subdomain of prod. After changing name of app in staging it worked
We had this issue, it turned out that our sessions table wasn't correct for the version of Laravel we were using. I'd recommend looking to see if it's being populated or remaining empty (like ours was).
If it's empty, even when you have people visiting the site, I'd say that's what the issue is.
(If you're not using a database to store your sessions, obviously I'd suggest checking wherever you are instead.)
My register page is showing the form properly with CsrfToken ({{ csrf_field() }}) present in the form).
Form HTML
<form class="form-horizontal registration-form" novalidate method="POST" action="{{ route('register') }}">
{{ csrf_field() }}
....
</form>
I am using inbuilt authentication for the users. Have not changed anything except the routes and redirects.
When I submit the form (just after reloading also), it gives that The page has expired due to inactivity. Please refresh and try again. error.
My be I am missing a very small thing. But not sure what it is. Any help?
Update
Found the issue. The session driver was set to array. Changed it to file and the error is gone now.
But what is wrong if I use array?
If you're coming to this answer directly from a search, make sure you have already added the csrf token to your form with {{ csrf_field() }} like the OP.
If you have your session driver set to file:
May have something to do with the storage_path not being writable. This is where it stores session data regarding tokens if you're using file based sessions. The can be verified with is_writable(config('session.files'))
For the OP, the session driver was set to array. Array is for testing only. Since data is not persisted, it will not be able to compare the token on the next request.
The array driver is used during testing and prevents the data stored
in the session from being persisted.
https://laravel.com/docs/5.5/session#configuration
Check config/session.php
Lastly, an issue I just had, we had a project which has the session domain and secure settings in config/session.php but the development site was not using HTTPS (SSL/TLS). This caused this generic error since sessions.secure was set to true by default.
I ran into the same issue in Laravel 5.5. In my case, it happened after changing a route from GET to POST. The issue was because I forgot to pass a CSRF token when I switched to POST.
You can either post a CSRF token in your form by calling:
{{ csrf_field() }}
Or exclude your route in app/Http/Middleware/VerifyCsrfToken.php
protected $except = [
'your/route'
];
Try all of them.
composer dump-autoload
php artisan optimize
php artisan cache:clear
php artisan config:clear
php artisan route:clear
php artisan view:clear
This caused because of Illuminate\Session\TokenMismatchException
look at this code sample how to handle it properly:
https://gist.github.com/jrmadsen67/bd0f9ad0ef1ed6bb594e
My case was solved with SESSION_DOMAIN, in my local machine had to be set to xxx.localhost. It was causing conflicts with the production SESSION_DOMAIN, xxx.com that was set directly in the session.php config file.
Some information is stored in the cookie which is related to previous versions of laravel in development. So it's conflicting with csrf generated tokens which are generated by another's versions. Just Clear the cookie and give a try.
For those who still has problem and nothing helped. Pay attention on php.ini mbstring.func_overload parameter. It has to be set to 0. And mbstring.internal_encoding set to UTF-8. In my case that was a problem.
I change permission to storage and error was gone. It seemed lack of permission was the issue.
sudo chmod -R 775 storage/
In my case, the site was fine in server but not in local. Then I remember I was working on secure website.
So in file config.session.php, set the variable secure to false
'secure' => env('SESSION_SECURE_COOKIE', false),
add #csrf in the form
and also go to VerifyCsrfToken.php
app->Http->Middleware->VerifyCsrfToken.php
protected $except = [
'paste your route here'
];
I have figured out two solution to avoid these error
1)by adding protected $except = ['/yourroute'] possible disable csrf token inspection from defined root.
2)just comment \App\Http\Middleware\VerifyCsrfToken::class line in protected middleware group in kernel
Short answer
Add the route entry for register in app/Http/Middleware/VerifyCsrfToken.php
protected $except = [
'/routeTo/register'
];
and clear the cache and the cache route with the commands:
php artisan cache:clear && php artisan route:clear
Details
Every time you access a Laravel site, a token is generated, even if the session has not been started. Then, in each request, this token (stored in the cookies) will be validated against its expiration time, set in the SESSION_LIFETIME field on config/session.php file.
If you keep the site open for more than the expiration time and try to make a request, this token will be evaluated and the expiration error will return. So, to skip this validation on forms that are outside the functions of authenticated users (such as register or login) you can add the except route in app/Http/Middleware/VerifyCsrfToken.php.
I had the app with multiple subdomains and session cookie was the problem between those. Clearing the cookies resolved my problem.
Also, try setting the SESSION_DOMAIN in .env file. Use the exact subdomain you are browsing.
Be sure to have the correct system time on your web server. In my case, the vagrant machine was in the future (Jan 26 14:08:26 UTC 2226) so of course the time in my browser's session cookie had expired some 200+ years ago.
set mbstring.func_overload = 2
it helped me
I had the same problem but the problem is not in the framework but in the browser. I don't know why but google chrome blocks cookies automatically, in my case. After allowed cookies the problem was resolved.
Many time its happening because you are testing project in back date
Solution:
use incognito new tab then test it again.
reason:
in my case another user logged in with my admin panel
I encountered the same issue on Linux-mint but then realized that the htdocs folder had no full permissions. So I changed the permissions of all the subdirectories in the htdocs folder by doing: sudo chown -c -R $USER:$USER /opt/lampp/htdocs/*
Sign in to connect to the server.
Search Error
An error has occurred: search false You don't have the peais.
Search request is longer.
Using laravel 5.1 this works fine on an ajax call:
$conn = Session::get('conn') or abort(500, 'No conn detected')
The variable is set and if the session key is not detected the error 500 is fired.
But on a brand new install of Laravel 5.4 the same code doesn't work, I can test it fine using a normal GET request but if I using ajax I always get the 500 error. I'm using the 'file' session session driver in both cases.
Did something change from Laravel 5.1 to 5.4 about session access on ajax call? I couldn't find any info about it.
Thanks!
In file app/Http/Kernel.php there is array $middlewareGroups and there \Illuminate\Session\Middleware\AuthenticateSession::class is commented. Uncomment this line and try again.
I am trying to implement session upload with zf2, but it fails with
"No upload in progress".
I am using ZfcUser and HtSession.
Have tried to work with provided example module https://github.com/cgmartin/ZF2FileUploadExamples, but i does not work with my project. (Same "no upload in progress")
So far i had tried to make it work with skeleton application, and it works, but when i add ZfcUser module, it gives same message.
As i think, it is because of session maded by zfcUser, but dont know how to avoid such thing.
And in skeleton application + file upload example, if i use ip address it works, if using domain - not("no upload in progress")
Thanks for helping!
UPD
If using uploadprogress php extension, both of them(uploadprogress and session progress) returns nothing.
If clear all session and cookies, then i able to upload file.
If i manually add somewhere session , then i dont able see progress, sometimes i get Erroneous data format for unserializing 'Zend\Stdlib\ArrayObject' in /var/www/html/vendor/zendframework/zend-session/src/SessionManager.php on line 109 and session_start() failed to decode session object. Session had been destroyed , sometimes just progress return "no upload in progress".
The thing with ZF2's Session Manager configured by default is it saves the session data as object. And if the class of that object is not available to PHP, it won't be able to deserialize it thus the error: missing 'Zend\Stdlib\ArrayObject'.
IMVHO you should configure the Session Manager to use a different session name instead of default PHPSESSID so it won't interfere with other scripts like your upload-progress-script.
I'm new to Laravel, I have learned about the models, views, blade, controllers and routes and how they work together. So far everything has been working smoothly.
I'm having trouble with sessions though.
When I use the AuthController that comes with Laravel and hit auth/register with a POST request, the data for the user that I register does get inserted into the users table (using mysql) and I do get back a response with the "Location" header redirecting to / like it does out of the box. It redirects like it should. But in the same response there is no "Set-Cookie" header set/sent. The session part of Laravel is not working properly for me. This is the same for a POST to auth/login, it authenticates properly and redirects to the profile page but no session cookie is sent back in the response.
I'm using:
Laravel 5.2.11
PHP 5.5.9
xubuntu 14.04 (Ubuntu)
Linux kernel 3.19.0-42-generic
Composer 1.0
All of the php modules that Laravel requires are installed. I'm running the app with php's built in web server. I run that with sudo. The exact command I run is this:
sudo php -S localhost:8888 -t public/
All routes are being responded to properly.
I have tried both ways of installing Laravel that the installation docs recommend, through the laravel executable and composer create-project. Still no cookies set either way. I have made all the files and directories of the laravel project mod 777. The app key is set in .env if that makes any difference.
The config/session.php file is using the file driver for the session.
There are no session files in the storage/framework/sessions directory after setting a session.
When I try setting a session myself with the session function like it states in the docs:
session(['sesskey' => 'somevalue']);
Again no "Set-Cookie" header is sent in the response and no session file is created. There are no error messages reported back either I should add.
When I do set a session key with the session function like above I can get that value back however and echo it back to the browser like so:
echo session('sesskey');
So it does seem to save it at least in php's memory.
When I try setting a cookie using the withCookie method, I do get the proper response with the Set-Cookie header set:
return response()->view('welcome')->withCookie(cookie("test", "val" , 3600));
I tried going down the illuminate rabbit hole to see if I could find a problem but that is a bit over my head atm.
Any help would be much appriciated, thanks!
in laravel 5.2 you need to use "web" middleware for your problem,like that
Route::group(['middleware' => ['web']], function () {
//
});
use middleware for the request \Illuminate\Session\Middleware\StartSession::class
Route::group(['middleware' => [\Illuminate\Session\Middleware\StartSession::class]], function () {
});