在2个选项卡中工作时如何修复会话过期 - Laravel 5.7

Question

I'm using Laravel 5.7, and use Auth system (from php artisan make:auth).Supposing in browser i have 2 tabs. In first tab, i set a button use ajax to send request to server and response success, but when open the second tab and do logout (or login) then comeback to the first tab (without reload first tab) try to do with button to send request, response now is error 419 status.

I think, there are some problem with session expired. I searched but nowhere make me feel good.

// tab 1

// front-end js
$("#button").click(function(){
   $.ajaxSetup({
      headers: {
        "X-CSRF-TOKEN": $("meta[name='csrf-token']").attr("content")
      }
  });
  $.ajax({
    url: "{{ route('test.post') }}",
    type: "post",
    dataType: "json",
    success: function(response){
        console.log(response);
    },
    error: function(){
        alert("error");
    }
 });
});

//server code
    public function post(Request $request){
        if(Auth::check()){
            return response()->json(["test" => 1]);
        }else{
            return response()->json(["test" => 0]);
        }
    }
// first click in tab 1: working normal
// turn on another tab a do log out or log in
// comeback tab 1 and click button: error with 419 status code ???

Now I want after login or logout in another tab then i can still click button working normal. If can't, are there any solution to keep connect to server by ajax, axios...(something like that)... to update data in front end. Thank you much

Answer 1

Laravel uses csrf tokens to protect your application from cross-site request forgery (CSRF) attacks. Every session has new csrf-token. In your case you are using 2 tabs, on second tab you do login and logout. So after login/logout your csrf-token expired for the tab 1, you have to refresh that tab, so you can get new csrf-token for the session. Or you can exclude your route from csrf protection https://laravel.com/docs/5.8/csrf#csrf-excluding-uris just add your route in app/Http/Middleware/VerifyCsrfToken $except array.