Laravel and AJAX sporadic errors 401 in proroll

Question

Im encodes the auction website in Laravel 5.0, which simulates real-time updates using an AJAX poll that runs every 5 seconds. The problem is that my server returns the sporadic status of HTTP 401.

My route is constructed as follows:

Route::post(auction/live/update, ' AuctionController@ajaxSendUpdate '); 

My controller looks like this:

 public function ajaxSendUpdate() { // Business logic: queries database, couple of Ifs, etc… $data = array('success' => true, 'otherStuff' => $myData); return Response::json($data); } 

Finally, my controller is configured as follows:

 // a bit of HTML function getAuctionUpdate() { setTimeout(function () { $.ajax({ type: "POST", url: "{!! url('auction/live/update')!!}", dataType: 'json', data: { auctionID: $('#auctionID').val() }, success: function (data) { if (data['success']) { // Updates some labels, etc. getAuctionUpdate(); // Rearms itself } } } }); // Not sure if all brackets are correct in this snippet but they are 100% on real code }, 5000); 

This code works fine about 95% times. However, it can break with two different results:

1) The server responds to error 401 after a while and is never restored. In this case, we need to log in again. After logging in, everything goes well, and this result will never be repeated.

2) The server responds with sporadic 401, but is restored in the next (or after several) polling requests.

Im uses Laravel 5.0 and the updated version of Xampp on Windows. The error is easily reproduced using WAMP on Windows. Not tested on Linux and OSX. I read this and this and sorted the topics on laracasts.com and other forums, but I can not solve the problem ...

Answer 1

After many hours of testing, I believe that I solved this problem, even if I do not quite understand how and even if it is a universal answer that can be applied to similar cases.

At the beginning of development, I had the VerifyCsrfToken middleware disabled in kernel.php, so I did not send _token with my AJAX requests. Enabling VerifyCsrfToken middleware and sending _token immediately caused HTTP 401 errors to disappear. Now I had another problem: even more sporadic HTTP 500 errors. A quick look at the logs showed that all HTTP 500 errors were caused by TokenMismatchException.

I came across this one . Following the instructions of the webpage, I put this in my master.page header:

 <meta name="csrf-token" content="{{ csrf_token() }}"> 

And this is on my master.page javascript:

 $.ajaxSetup({ headers: { 'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content') } }); 

And somehow everything is fine. So, for all goals and objectives, my original problem has been solved, but I still can not understand:

1 - Why did I get sporadic HTTP 401 errors when I did not send any _token with my AJAX requests if I had verified the VerifyCsrfToken middleware in kernel.php?

2 - Why did I start receiving a sporadic TokenMismatchException when I turned on the VerifyCsrfToken middleware in kernel.php if I started sending _token with my AJAX requests?

3 - Why did X-CSRF-TOKEN finally solve the problem with the HTTP 500 error? Keep in mind that all errors were sporadic and not constant: I would venture to say that 95 to 98% of all AJAX requests went well, only a small number of them had any problems.