HTTP 419 Page Expired
Updated Free mock REST & WebSocket APIs
HTTP 419 Page Expired — Laravel's response when the CSRF token is missing or expired, usually after a session times out.
- Class
- 4xx Client Error
- Defined in
- Unofficial (Laravel)
- Official
- No — Laravel-specific
- Cacheable by default
- No (unless Cache-Control/Expires say so)
- Safe to retry
- Not without changing the request
Try it: get a real 419 response
Our test endpoint answers every request with 419 Page Expired.
curl -i https://mockfox.dev/api/status/419Use it in tests, health-check monitors or to see how your client handles a 419. Add ?delay=2000 to slow it down.
What does HTTP 419 mean?
Not a registered code. Laravel's VerifyCsrfToken middleware returns 419 when a form or AJAX request has no valid _token / X-CSRF-TOKEN, typically because the page sat open longer than the session lifetime (120 minutes by default) or the session cookie wasn't sent. Fix it by refreshing the page, including @csrf in forms, and checking SESSION_DOMAIN / SameSite settings.
How to fix 419
- Visitors: Reload the page, check the address for typos, and clear the site's cookies. If it persists, the site owner needs to fix it.
- Developers: Read the response body and server logs for details, fix the request (method, headers, body, credentials) and return a clear error message to clients.
Example 419 response
HTTP/1.1 419 Page Expired
Content-Type: application/json
{"status":419,"error":"Page Expired"}4xx Client Error: The request contains an error or can't be fulfilled — fix the request before retrying. See the full list of HTTP status codes.
Related status codes
- 401 UnauthorizedThe request lacks valid authentication credentials; it must include a WWW-Authenticate challenge.
- 403 ForbiddenThe server understood the request but refuses to authorize it.
- 422 Unprocessable ContentThe request is well-formed, but its contents fail validation.
Related tools
Frequently asked questions
What does HTTP 419 Page Expired mean?
Laravel's response when the CSRF token is missing or expired, usually after a session times out.
Is 419 a client or a server error?
419 is a 4xx code, so it signals a problem with the request (as seen by the server). Retrying the identical request usually gives the same result.
Is 419 an official HTTP status code?
No. It isn't in the IANA HTTP Status Code Registry; it's specific to Laravel. Generic HTTP clients treat it as an unknown 4xx status.
How can I test how my app handles a 419?
Call https://mockfox.dev/api/status/419 — it responds with 419 to any method, with CORS enabled. Add ?delay=2000 to simulate a slow response.