Framework: Csrf token is regenerated in the session after several Ajax requests in a short time

[eissasoubhi]

Hi,
i'm working on a Laravel 5.1 app where the user can upload many images (one by one).

the problem i have is the token is regenerated in the session after uploading couple images via ajax,
so the next image wont be uploaded because Laravel tries to compare the old csrf token (when i first opened new content form) with the new one regenerated in the session.
i dug into Laravel files and i figured out that the token is being regenerated by this function in
vendor/laravel/framework/src/illuminate/session/store.php file :

public function start()
    {
        $this->loadSession();

        if (! $this->has('_token')) {
            $this->regenerateToken();
        }

        return $this->started = true;
    }

here is an example :

click the images for a full screen

test part 1

test part 2

[it-can]

does this also happen on laravel 5.2?

[GrahamCampbell]

Sorry, this is a duplicate.

[KingMob]

@GrahamCampbell Which is it a duplicate of? #8172? That issue was closed, but not actually resolved. The same issue started occurring for me a week ago, and perusing the issues, it appears there's longstanding subtle concurrent session bugs for at least a year now. If this has actually been solved somewhere, I'd love to know the solution. Even a Laracast or forum post directing how to avoid it would be useful.

My personal guess is it's some sort of concurrency bug involving saving large amounts of session data in the terminate() method, which is after data has been sent out to client, so incoming requests are already hitting the server again. In my case, at least, it has nothing to with driver (tried memcache, apc, and file).

[eissasoubhi]

Before i opened this issue i've googled it and i didn't find any convenient answer. just hacking ways.
so if this issue is duplicated and SOLVED, plz i'd love to know

[nickbr5]

I also experience this error.
I have a dynamic resize url for image, when the images are loaded my session is changed for every request and in the end not valid anymore.
Any solutions would be great.

[eissasoubhi]

to solve that in my situation i just added the post URI to $except attribute of VerifyCsrfToken Middleware (AppHttpMiddlewareVerifyCsrfToken) .

see https://laravel.com/docs/master/routing#csrf-protection

[sebastianvirlan]

So nobody want to solve this important issue. Also happening on redis or database session driver.

[eissasoubhi]

maybe that has something to do with the browser, it works fine on Mozilla Firefox !

[optimalresource]

to solve that in my situation i just added the post URI to $except attribute of VerifyCsrfToken Middleware (AppHttpMiddlewareVerifyCsrfToken) .

see https://laravel.com/docs/master/routing#csrf-protection

This is not supposed to be a good solution, as that will open up many possibilities. For any post to db, a csrf token ought to be verified. I feel the best solution would be to create a route to refresh the tokens and pass the refreshed token to the meta header dynamically upon each Ajax request.