Laravel图片上传遇TokenMismatchException报错的解决方法

Hey there, let’s work through this TokenMismatchException you’re hitting when uploading images. This error is tied to Laravel’s CSRF protection, so here are practical steps to resolve it:

• Ensure the CSRF token is properly included in your upload form
  If your script uses Laravel Blade templates, make sure the upload form includes the @csrf directive right inside the <form> tag. If it’s a plain HTML form, add this hidden input manually:

  <input type="hidden" name="_token" value="{{ csrf_token() }}">
  

  For AJAX-based uploads, you’ll need to send the token in the request headers. First, confirm your page has this meta tag in the <head>:

  <meta name="csrf-token" content="{{ csrf_token() }}">
  

  Then, in your AJAX code, include the header:

  $.ajax({
      url: '/your-upload-endpoint',
      type: 'POST',
      headers: {
          'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
      },
      // rest of your upload logic
  });
  

• Verify session storage permissions and configuration
  Laravel needs write access to its session storage directory. Check that the storage/framework/sessions/ folder has proper permissions (usually 755 or 775). Also, open config/session.php and confirm the driver setting matches your hosting environment (e.g., file is fine for most setups, but some hosts require database).

• Temporarily exclude the upload route from CSRF protection (for testing only)
  This is a diagnostic step, not a permanent fix (it weakens security). Open app/Http/Middleware/VerifyCsrfToken.php and add your upload route to the $except array:

  protected $except = [
      '/path-to-your-upload-route',
  ];
  

  If the upload works after this, the issue is definitely a missing or invalid CSRF token in your request. Remove this exclusion once you fix the token issue.

• Clear Laravel caches and sessions
  Stale cache or corrupted session data can cause token mismatches. Run these Artisan commands if you have command-line access:

  php artisan cache:clear
  php artisan config:clear
  php artisan session:clear
  

  If you can’t use the command line, manually delete all files in storage/framework/cache/ and storage/framework/sessions/.

• Check for script-specific session modifications
  Some Codecanyon scripts tweak Laravel’s default session behavior. Review the script’s documentation or source code to see if there are any required configurations (like custom session drivers or domain settings) you missed.

If none of these steps resolve the issue, reach out to the script’s author on Codecanyon—they’ll have the most insight into how their code interacts with Laravel’s CSRF system.

内容的提问来源于stack exchange，提问作者Pint Raj