title: 419 page expired laravel page in iframe
body: <p>I am opening a page developed using <code>Laravel-7</code> inside an iframe in an angular project. The page is displaying the records. But while creating or updating a record the page throws 419 error.</p>
  <p>I have update the 'same_site' =&gt; 'none' and it didn't help.</p>
  <p>Both projects are deployed in GCP</p>
  <p>I have attached my session.php file .</p>
  <pre><code>&lt;?php
  
  use Illuminate\Support\Str;
  
  return [
  
  /*
  |--------------------------------------------------------------------------
  | Default Session Driver
  |--------------------------------------------------------------------------
  |
  | This option controls the default session &quot;driver&quot; that will be used on
  | requests. By default, we will use the lightweight native driver but
  | you may specify any of the other wonderful drivers provided here.
  |
  | Supported: &quot;file&quot;, &quot;cookie&quot;, &quot;database&quot;, &quot;apc&quot;,
  |            &quot;memcached&quot;, &quot;redis&quot;, &quot;dynamodb&quot;, &quot;array&quot;
  |
  */
  
  'driver' =&gt; env('SESSION_DRIVER', 'file'),
  
  /*
  |--------------------------------------------------------------------------
  | Session Lifetime
  |--------------------------------------------------------------------------
  |
  | Here you may specify the number of minutes that you wish the session
  | to be allowed to remain idle before it expires. If you want them
  | to immediately expire on the browser closing, set that option.
  |
  */
  
  'lifetime' =&gt; env('SESSION_LIFETIME', 120),
  
  'expire_on_close' =&gt; false,
  
  /*
  |--------------------------------------------------------------------------
  | Session Encryption
  |--------------------------------------------------------------------------
  |
  | This option allows you to easily specify that all of your session data
  | should be encrypted before it is stored. All encryption will be run
  | automatically by Laravel and you can use the Session like normal.
  |
  */
  
  'encrypt' =&gt; false,
  
  /*
  |--------------------------------------------------------------------------
  | Session File Location
  |--------------------------------------------------------------------------
  |
  | When using the native session driver, we need a location where session
  | files may be stored. A default has been set for you but a different
  | location may be specified. This is only needed for file sessions.
  |
  */
  
  'files' =&gt; storage_path('framework/sessions'),
  
  /*
  |--------------------------------------------------------------------------
  | Session Database Connection
  |--------------------------------------------------------------------------
  |
  | When using the &quot;database&quot; or &quot;redis&quot; session drivers, you may specify a
  | connection that should be used to manage these sessions. This should
  | correspond to a connection in your database configuration options.
  |
  */
  
  'connection' =&gt; env('SESSION_CONNECTION', null),
  
  /*
  |--------------------------------------------------------------------------
  | Session Database Table
  |--------------------------------------------------------------------------
  |
  | When using the &quot;database&quot; session driver, you may specify the table we
  | should use to manage the sessions. Of course, a sensible default is
  | provided for you; however, you are free to change this as needed.
  |
  */
  
  'table' =&gt; 'sessions',
  
  /*
  |--------------------------------------------------------------------------
  | Session Cache Store
  |--------------------------------------------------------------------------
  |
  | While using one of the framework's cache driven session backends you may
  | list a cache store that should be used for these sessions. This value
  | must match with one of the application's configured cache &quot;stores&quot;.
  |
  | Affects: &quot;apc&quot;, &quot;dynamodb&quot;, &quot;memcached&quot;, &quot;redis&quot;
  |
  */
  
  'store' =&gt; env('SESSION_STORE', null),
  
  /*
  |--------------------------------------------------------------------------
  | Session Sweeping Lottery
  |--------------------------------------------------------------------------
  |
  | Some session drivers must manually sweep their storage location to get
  | rid of old sessions from storage. Here are the chances that it will
  | happen on a given request. By default, the odds are 2 out of 100.
  |
  */
  
  'lottery' =&gt; [2, 100],
  
  /*
  |--------------------------------------------------------------------------
  | Session Cookie Name
  |--------------------------------------------------------------------------
  |
  | Here you may change the name of the cookie used to identify a session
  | instance by ID. The name specified here will get used every time a
  | new session cookie is created by the framework for every driver.
  |
  */
  
  'cookie' =&gt; env(
      'SESSION_COOKIE',
      Str::slug(env('APP_NAME', 'laravel'), '_').'_session'
  ),
  
  /*
  |--------------------------------------------------------------------------
  | Session Cookie Path
  |--------------------------------------------------------------------------
  |
  | The session cookie path determines the path for which the cookie will
  | be regarded as available. Typically, this will be the root path of
  | your application but you are free to change this when necessary.
  |
  */
  
  'path' =&gt; '/',
  
  /*
  |--------------------------------------------------------------------------
  | Session Cookie Domain
  |--------------------------------------------------------------------------
  |
  | Here you may change the domain of the cookie used to identify a session
  | in your application. This will determine which domains the cookie is
  | available to in your application. A sensible default has been set.
  |
  */
  
  'domain' =&gt; env('SESSION_DOMAIN', null),
  
  /*
  |--------------------------------------------------------------------------
  | HTTPS Only Cookies
  |--------------------------------------------------------------------------
  |
  | By setting this option to true, session cookies will only be sent back
  | to the server if the browser has a HTTPS connection. This will keep
  | the cookie from being sent to you if it can not be done securely.
  |
  */
  
  'secure' =&gt; env('SESSION_SECURE_COOKIE', false), 
  
  /*
  |--------------------------------------------------------------------------
  | HTTP Access Only
  |--------------------------------------------------------------------------
  |
  | Setting this value to true will prevent JavaScript from accessing the
  | value of the cookie and the cookie will only be accessible through
  | the HTTP protocol. You are free to modify this option if needed.
  |
  */
  
  'http_only' =&gt; true,
  
  /*
  |--------------------------------------------------------------------------
  | Same-Site Cookies
  |--------------------------------------------------------------------------
  |
  | This option determines how your cookies behave when cross-site requests
  | take place, and can be used to mitigate CSRF attacks. By default, we
  | will set this value to &quot;lax&quot; since this is a secure default value.
  |
  | Supported: &quot;lax&quot;, &quot;strict&quot;, &quot;none&quot;, null
  |
  */
  
  'same_site' =&gt; 'none',
  
  ];
  </code></pre>
  <p>Please help me to fix this issue.</p>