Why does my Laravel form throw a 419 Page Expired error only sometimes?

A 419 is a CSRF TokenMismatchException: the request reached Laravel without a valid token. Intermittent 419s usually mean the session/CSRF cookie expired while the user sat on the page, the page was served from an HTML cache (Cloudflare) with a stale token, or SESSION_DOMAIN/SameSite is mis-scoped so the cookie never matched. Capture the failing request's headers and you can see immediately whether the X-XSRF-TOKEN header or _token field was present, expired, or missing.

How do I debug an Inertia.js 419 error in a Laravel + React/Vue app?

Inertia v2 has no built-in 419 handler, so a token mismatch surfaces as a generic modal instead of a clear message. Confirm the XSRF-TOKEN cookie exists and Axios is attaching it as the X-XSRF-TOKEN header on the failing POST, then fix it server-side: catch 419 in bootstrap/app.php and return back()->with(['message' => 'The page expired.']) so Inertia receives a valid redirect with a flash prop. A captured session shows the exact request that failed plus the cookie state at that instant.

Why are my Laravel validation errors not showing up in the browser?

Laravel handles validation two ways. A traditional web request redirects back with errors flashed to the session, so you must read them via the $errors bag or @error in Blade and repopulate inputs with old(). An XHR request instead returns HTTP 422 with a JSON errors object your JavaScript has to render, and nothing appears automatically. If errors vanish, you are almost always rendering the wrong response type for how the form actually submits; the network response status (302 vs 422) tells you which path ran.

Can BugMojo capture the network request behind a 419 or 422 Laravel error?

Yes. BugMojo records the network HAR for the captured session, so the failing POST, its status (419 or 422), the request headers (whether X-XSRF-TOKEN was sent), and the JSON validation body are all in the report, alongside an rrweb DOM replay of what the user did and the browser console. You see both the user's action sequence and the server's exact response, which is the part a screenshot can never show.

Does BugMojo work with Blade, Livewire, and Inertia Laravel apps?

Yes. BugMojo is a browser extension, not a PHP SDK, so it captures from the rendered page regardless of how Laravel produced it: server-rendered Blade, Livewire's reactive DOM updates, or Inertia-driven React/Vue. There is nothing to install in composer and no per-stack integration; the same capture works across Laravel 11, 12, and 13. For Livewire, the replay shows whether wire:submit ran a server round-trip or a stray native POST bypassed it.

How is BugMojo different from Laravel Telescope or Sentry for catching bugs?

Telescope and Sentry watch the server: Telescope logs requests, queries, and exceptions in local development, and Sentry is strong at production error monitoring and aggregation. BugMojo works at the other end, the user's actual browser, capturing the DOM replay, console, and network HAR for one specific reported bug. For mature always-on production error tracking Sentry is more complete; for reproducing exactly what a tester or user saw, BugMojo gives you the session, and its MCP server lets Claude Code or Cursor read that report directly in the IDE.

Bug tracking by framework

Bug tracking for Laravel — session replay, console + HAR (2026)

Laravel bug-reporting guide for QA + dev teams: framework-specific gotchas, common bugs, and how to capture them with BugMojo session replay.

5 min readPHP

Isometric thin line-art browser rendering a Laravel form with a 419/422 HTTP request card peeling off toward an IDE node, lit by a single lime glow

What Laravel teams ship with BugMojo

Laravel reports a validation failure two completely different ways depending on how the request arrived. A traditional Blade or Inertia full-page POST gets a 302 redirect back with errors flashed to the session (the $errors MessageBag) plus the old() input; an XHR or JSON request to the same controller, hitting the same FormRequest, gets an HTTP 422 with a structured {message, errors{}} body that uses dot notation for nested fields like "users.0.email". Same code, two browser-visible outcomes, which is exactly why a screenshot is ambiguous and a captured network HAR is decisive.

The other Laravel bug that dominates support queues is the 419 Page Expired, a TokenMismatchException raised when a POST, PUT, PATCH, or DELETE arrives without a valid CSRF token. The @csrf Blade directive injects it into server-rendered forms, but an Inertia + Axios SPA must send it as the X-XSRF-TOKEN header read from the XSRF-TOKEN cookie, and a stale or mis-scoped SESSION_DOMAIN silently breaks the match. This guide is for Laravel teams shipping Blade, Livewire, and Inertia (React/Vue) in 2026: what these failures look like in the browser, and how to capture the exact request that caused them.

Laravel gotchas

Framework-specific failure modes engineers actually ship through. Each is hard to spot in a screenshot and obvious in a session replay.

Common Laravel bugs

Real Laravel bug patterns — the symptom you will see in a report and the fix that actually works.

Validation errors never appear on an XHR-submitted form

Symptom: A fetch/Axios form submit fails silently with no inline errors and no toast. The user retypes and resubmits with no feedback at all.

Fix: An XHR request returns 422 with a JSON errors object; nothing renders automatically, so your JS must read response.data.errors and paint it. Confirm the response is 422 (not a 302 your client followed into HTML), then map the dot-notation keys to fields. The captured HAR shows the 422 body that your UI ignored.

jsonjson

// 422 body Laravel returns for an XHR request
{
  "message": "The given data was invalid.",
  "errors": {
    "email": ["The email field is required."],
    "address.zip": ["The address.zip must be 5 digits."]
  }
}

Every POST in an Inertia app returns 419 Page Expired

Symptom: Forms worked yesterday; today every submit shows a generic Inertia error modal. GET pages still load fine, so it looks framework-wide.

Fix: The XSRF-TOKEN cookie is missing or out of scope, so Axios never sends X-XSRF-TOKEN. Set SESSION_DOMAIN to your apex domain, confirm the cookie is present on the failing request, and handle 419 server-side so users get a real message instead of a modal.

phpphp

// bootstrap/app.php — turn a raw 419 into a usable Inertia redirect
->withExceptions(function (Exceptions $exceptions) {
    $exceptions->respond(function (Response $response) {
        if ($response->getStatusCode() === 419) {
            return back()->with([
                'message' => 'The page expired, please try again.',
            ]);
        }
        return $response;
    });
})

Livewire form does a full page reload and loses errors

Symptom: Submitting a Livewire form reloads the whole page and any previously shown validation errors disappear instead of updating in place.

Fix: The submit handler is missing wire:submit.prevent (or wire:submit), so the browser performs a native POST and bypasses Livewire. Add wire:submit to the form so $this->validate() runs server-side and the reactive $errors bag re-renders without a reload.

bladeblade

{{-- bug: native POST bypasses Livewire --}}
<form action="/save" method="POST">

{{-- fix: Livewire round-trip, reactive $errors --}}
<form wire:submit="save">

BugMojo vs alternatives

The honest comparison — where BugMojo wins, and where another tool might serve you better.

Feature	BugMojo	Telescope / Sentry
DOM session replay of the user's exact steps	Yes, rrweb-based	Partial: Sentry replay (sampled)
Network HAR with the 419/422 request + headers	Yes, shows X-XSRF-TOKEN present/missing	Partial: server-side view only
Captures from Blade, Livewire & Inertia uniformly	Yes, browser-layer, no SDK	Partial: needs server instrumentation
MCP server: Claude Code / Cursor read the report in the IDE	Yes, bug is a first-class assignee	No, neither Telescope nor Sentry has this
Always-on production error monitoring & aggregation	No, on-demand capture only	Yes, Sentry is more complete here
Local request/query/exception inspection	No	Yes, Telescope in local dev
Console + network (HAR) capture	✓	Partial
Zero-setup Quick Capture	No project, no SDK	Account / SDK required

The BugMojo column is highlighted. The closing rows are BugMojo’s core wedge: rrweb session replay, MCP for AI agents, console + network capture, and zero-setup Quick Capture.

Capture your next bug in 15 seconds

BugMojo records the DOM, console, and network — then ships a one-click ticket with the full replay attached. No SDK, no setup.

Try BugMojo free

Frequently asked questions

Sources

Laravel 12.x validation — 302 redirect with $errors/old() vs 422 JSON {message, errors{}} (dot notation) — Laravel (official docs, v12.x) (2025)
Inertia.js v2 CSRF protection — XSRF-TOKEN cookie, X-XSRF-TOKEN header, 419 modal, bootstrap/app.php fix — Inertia.js (official docs) (2025)
Laravel Livewire v4 validation — $this->validate(), reactive $errors bag, wire:submit, wire:model.live — Laravel Livewire (official docs, v4.x) (2026)
419 Page Expired Error in Laravel — How to fix it (@csrf, SESSION_DOMAIN, HTTPS/HTTP, cache, CSRF excludes) — SaaSykit (2024)
State of PHP 2025 — Laravel 64% of 1,720 PHP-primary developers, WordPress 25%, Symfony 23% — JetBrains (PhpStorm blog) (2025-10)

What Laravel teams ship with BugMojo

Laravel gotchas

Common Laravel bugs

Validation errors never appear on an XHR-submitted form

Every POST in an Inertia app returns 419 Page Expired

Livewire form does a full page reload and loses errors

BugMojo vs alternatives

Frequently asked questions

Frequently asked questions

Why does my Laravel form throw a 419 Page Expired error only sometimes?

How do I debug an Inertia.js 419 error in a Laravel + React/Vue app?

Why are my Laravel validation errors not showing up in the browser?

Can BugMojo capture the network request behind a 419 or 422 Laravel error?

Does BugMojo work with Blade, Livewire, and Inertia Laravel apps?

How is BugMojo different from Laravel Telescope or Sentry for catching bugs?

Sources

More frameworks

What Laravel teams ship with BugMojo

Laravel gotchas

Common Laravel bugs

Validation errors never appear on an XHR-submitted form

Every POST in an Inertia app returns 419 Page Expired

Livewire form does a full page reload and loses errors

BugMojo vs alternatives

Frequently asked questions

Frequently asked questions

Why does my Laravel form throw a 419 Page Expired error only sometimes?

How do I debug an Inertia.js 419 error in a Laravel + React/Vue app?

Why are my Laravel validation errors not showing up in the browser?

Can BugMojo capture the network request behind a 419 or 422 Laravel error?

Does BugMojo work with Blade, Livewire, and Inertia Laravel apps?

How is BugMojo different from Laravel Telescope or Sentry for catching bugs?

Sources

More frameworks