arrow_back Return to Posts

Inertia 419 Error Caused by Subdomain XSRF-TOKEN Conflict
By Godwin Udofia in October 2023 ~ Laravel

The problem

An Inertia application (which I will refer to as App #2) running on a subdomain (two.example.org.ng) was returning a 419 Page Expired Error for no reason (or so I thought) if a different application (which I will refer to as App #1) running on a different subdomain (one.example.org.ng) is launched on the same browser.

It was apparently a session issue and after several hours of frustration it turns out that the issue was caused by conflicting XSRF-TOKEN tokens.

The solution

The cause was actually trivial and the solution was in the .env file.

.env file of App #1
SESSION_DOMAIN=.example.org.ng
.env file of App #2
SESSION_DOMAIN=.two.example.org.ng

Setting SESSION_DOMAIN=.example.org.ng in App #1 caused the session cookie domain to be set to the parent domain for App #1. The same cookie was also available for App #2 because two.example.org.ng because lives on the same parent domain as one.example.org.ng and caused the issue.

Strictly scoping the session domain for App #1 to the subdomain on which it lives solved the problem.

.env file of App #1 (solution)
SESSION_DOMAIN=.one.example.org.ng

Comments