L5 random TokenMismatchExceptions

Question

I'm getting random TokenMismatchExceptions in Laravel 5. Using the following code in the tokensMatch() function I've been trying to debug this weird issue:

Log::debug($request->session()->token(). ', ' . $token);

The output is as follows:

[2015-03-21 17:04:22] local.DEBUG: XJhAXXQumM0JLX9tFcQn1tQZMI1FtglDFuhi8abT, XJhAXXQumM0JLX9tFcQn1tQZMI1FtglDFuhi8abT  
[2015-03-21 17:04:34] local.DEBUG: XJhAXXQumM0JLX9tFcQn1tQZMI1FtglDFuhi8abT, XJhAXXQumM0JLX9tFcQn1tQZMI1FtglDFuhi8abT  
[2015-03-21 17:04:36] local.DEBUG: snE0IERJ1VY0o4qmSMuHb4wH9lhQUf5ZtVObOFnR, XJhAXXQumM0JLX9tFcQn1tQZMI1FtglDFuhi8abT  
[2015-03-21 17:04:36] local.ERROR: exception 'Illuminate\Session\TokenMismatchException' in vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\VerifyCsrfToken.php:47
Stack trace:
[...]
[2015-03-21 17:07:30] local.DEBUG: XJhAXXQumM0JLX9tFcQn1tQZMI1FtglDFuhi8abT, XJhAXXQumM0JLX9tFcQn1tQZMI1FtglDFuhi8abT

As you can see, the first 2 requests succeed, the 3rd one fails and the 4th one succeeds again. I've been using Fiddler and Chrome network tools and I can confirm that the exact same data was sent to the server for all requests.

So it seems the token changes on the server side. The weird thing is that the token in the session file doesn't seem to change, and the wrong token is always a string I haven't seen before, but always gets reverted to the original string somehow.

This happens pretty often, so it's really annoying. First I thought it may be something about the database session driver, but I'm using the file driver now and it's still happening.

Update

I keep having this problem. I have it on different PC's and different projects using php artisan serve. I also have it on different servers and different projects (nginx 1.6.2, PHP 5.6.7).

I'm not the only one with this problem.

It's pretty hard to debug as it happens randomly, sometimes it doesn't show up for some time and then suddenly it happens many times in a row, or just once. By simply resubmitting the POST request it sometimes works again, or sometimes results in another exception.

Only thing I added to composer.json in all projects is "illuminate/html": "5.*". All composer packages are up-to-date.

I'll update this question as soon as I've more info regarding this really weird problem.

Another update

I created a new L5 project, and added some minimal code to reproduce this error. The changes I made can be seen here (along with the complete test project). I'll try some debugging with this project now.

Answer 1

This is a known issue with Laravel 5 for some people.

There is an open Github issue ticket on this topic here: https://github.com/laravel/framework/issues/8172

The cause is not yet known, and it has been going on for a while. There are a lot of smart people looking into it - but the apparent randomness of the issue is making it difficult to debug.

I suggest you contribute your information to that ticket and keep an eye there for further information.