title: HTTP status code 419 when accessing Laravel api by browser
body: <p>I can't access my laravel api post routes at localhost by browser (script / console / dev-tools). I'm always getting HTTP 419 (Page Expired) status error. Interestingly I can access the api with success via postman.</p>
  <p>The routes are outside of everey &quot;auth:sanctum&quot; group, so that this should not be the cause of failure. Because of this I also think that sessions and session config could not be the cause, could they?</p>
  <pre><code>// routes/api.php
  Route::post('/test', function() {
      return &quot;Hello World @ POST&quot;;
  }); // =&gt; HTTP 419
  
  Route::get('/test', function() {
      return &quot;Hello World @ GET&quot;;
  }); // =&gt; HTTP 200
  </code></pre>
  <p>I excluded the path from xsrf-checks, to exclude this error cause:</p>
  <pre><code>// VerifyCsrfToken.php
  protected $except = [
      'api/test',
  ];
  </code></pre>
  <p>The script I run in firefox console:</p>
  <pre><code>await fetch(&quot;http://localhost:8000/api/test&quot;, {
      &quot;method&quot;: &quot;POST&quot;
  });
  </code></pre>
  <p>The HTTP request firefox sends to localhost:</p>
  <pre><code>POST /api/test HTTP/1.1
  Host: localhost:8000
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
  Accept: */*
  Accept-Language: de,en-US;q=0.7,en;q=0.3
  Accept-Encoding: gzip, deflate
  Referer: http://127.0.0.1:8000/
  Origin: http://127.0.0.1:8000
  Connection: keep-alive
  Sec-Fetch-Dest: empty
  Sec-Fetch-Mode: cors
  Sec-Fetch-Site: cross-site
  Content-Length: 0
  </code></pre>
  <p>What can I do to get my api running in the browser?</p>
  <p><strong>EDIT#1</strong></p>
  <p>app/http/kernel.php</p>
  <pre><code>&lt;?php
  
  namespace App\Http;
  
  use Illuminate\Foundation\Http\Kernel as HttpKernel;
  
  class Kernel extends HttpKernel
  {
      /**
       * The application's global HTTP middleware stack.
       *
       * These middleware are run during every request to your application.
       *
       * @var array&lt;int, class-string|string&gt;
       */
      protected $middleware = [
          // \App\Http\Middleware\TrustHosts::class,
          \App\Http\Middleware\TrustProxies::class,
          \Illuminate\Http\Middleware\HandleCors::class,
          \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
          \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
          \App\Http\Middleware\TrimStrings::class,
          \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
      ];
  
      /**
       * The application's route middleware groups.
       *
       * @var array&lt;string, array&lt;int, class-string|string&gt;&gt;
       */
      protected $middlewareGroups = [
          'web' =&gt; [
              \App\Http\Middleware\EncryptCookies::class,
              \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
              \Illuminate\Session\Middleware\StartSession::class,
              // \Illuminate\Session\Middleware\AuthenticateSession::class,
              \Illuminate\View\Middleware\ShareErrorsFromSession::class,
              \App\Http\Middleware\VerifyCsrfToken::class,
              \Illuminate\Routing\Middleware\SubstituteBindings::class,
          ],
          
          'api' =&gt; [
              \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
              'throttle:api',
              \Illuminate\Routing\Middleware\SubstituteBindings::class,
          ],
      ];
  
      /**
       * The application's route middleware.
       *
       * These middleware may be assigned to groups or used individually.
       *
       * @var array&lt;string, class-string|string&gt;
       */
      protected $routeMiddleware = [
          'auth' =&gt; \App\Http\Middleware\Authenticate::class,
          'auth.basic' =&gt; \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
          'cache.headers' =&gt; \Illuminate\Http\Middleware\SetCacheHeaders::class,
          'can' =&gt; \Illuminate\Auth\Middleware\Authorize::class,
          'guest' =&gt; \App\Http\Middleware\RedirectIfAuthenticated::class,
          'password.confirm' =&gt; \Illuminate\Auth\Middleware\RequirePassword::class,
          'signed' =&gt; \Illuminate\Routing\Middleware\ValidateSignature::class,
          'throttle' =&gt; \Illuminate\Routing\Middleware\ThrottleRequests::class,
          'verified' =&gt; \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
      ];
  }
  
  </code></pre>