APITester| Status code | 419 |
|---|---|
| Status text | Page Expired |
| Category | 4xx Client Error |
| Response has body | Usually |
| Defined by | Laravel framework (not an IANA-registered code) |
What does 419 Page Expired mean?
The request failed the CSRF check: its token was missing, wrong, or belonged to a session that has ended. It is numbered in the 4xx Client Error range but is not a registered HTTP status code, so the general meaning of that class is only a rough guide to it.
When do APIs return 419?
On applications built with Laravel, which answers 419 when a POST, PUT, PATCH or DELETE to a web route arrives without a valid CSRF token. The usual triggers are a form left open until the session expired, a form missing its token field, an AJAX call that does not send the X-CSRF-TOKEN header, or session cookies that are not coming back because of a domain or SameSite setting.
How to fix a 419 Page Expired
Reload the page to get a fresh token and submit again. As the developer, make sure every form includes the token and every script request sends it in a header. If you are calling the application as an API, from a script or an API tester, you are hitting a browser route: use the routes meant for API clients, which authenticate with a token instead of a session and are not subject to the CSRF check.
Reproduce a 419 response
The fastest way to understand a status code is to trigger one and read the full response. Open the
API tester and send a request to https://httpbin.org/status/419 — you will
see the 419 status along with every response header the server sent. Comparing those headers against
a working request is often what reveals the cause.
That response only imitates the number, which is useful for checking how your own client, alerting or retry logic treats a 419. A real one comes from the software named in the table above, in the circumstances this page describes.
When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.
Related 4xx status codes
400 Bad Request
The server could not understand the request because it is malformed.
401 Unauthorized
The request lacks valid authentication credentials. Despite the name, this means unauthenticated.
402 Payment Required
The request cannot be processed until payment is made.
403 Forbidden
The server understood the request and knows who you are, but refuses to authorise it.
404 Not Found
The server cannot find the requested resource.
405 Method Not Allowed
The endpoint exists but does not support the HTTP method you used.
419 Page Expired FAQ
Is 419 an official HTTP status code?
No. It is not in the IANA registry and no RFC defines it. It is a convention of the Laravel PHP framework, which uses it for a failed CSRF token check, so you will only see it from applications built with Laravel.
Why do I get 419 when testing a Laravel route with an API client?
Because the route is in the web middleware group, which requires a CSRF token tied to a browser session. Call a route defined for API use instead, or fetch the token first and send it in an X-CSRF-TOKEN header along with the session cookie.
What is the difference between 419 and 403?
403 Forbidden is the standard code for a request the server understood and refuses to authorise. 419 is Laravel's more specific signal that the refusal was a missing or stale CSRF token, which a page reload normally fixes.
See also
- 403 Forbidden — The server understood the request and knows who you are, but refuses to authorise it.
- 401 Unauthorized — The request lacks valid authentication credentials. Despite the name, this means unauthenticated.
References
- Laravel Docs: CSRF Protection — How the token is issued and checked in the framework that uses this code.
- IANA: HTTP Status Code Registry — The official list of registered codes. This one is not on it.