419 Page expired when selecting a different date range

[wecoyote5]

Hello,
Great work on this app! I've been using FF for about a month and a half now and since the recent update everything, as far as I can tell, is working ok; I can import transactions, edit them, create, etc. But when I try to select a different date range I get the 419 Page Expired Error, and so far, only trying to change the date range causes it. I've tried restarting the stack, updating env variables after reading about previous issues, clearing the cache, etc. I'm running a simple docker setup with local access only so I'm not behind a reverse proxy. What can I check to see what's causing it?
Thanks!

[JC5]

Hey, thanks for starting this discussion.

Mmm, I have a hard time seeing this on the demo site. It might be something in your configuration, but I can't be sure. You're not the only one with this issue.

Could you share the output of the /debug page?

Cheers,
James

[adam50hhh]

I have the same issue too.
Upgraded from 6.6.6 to 6.7.1. Date-range selection worked before the upgrade. Clearing cache/restarting the container and testing in a fresh private browser session did not resolve it.
firefly-671-debug-sanitized.log
Debug log attached.
Thank you for your hard work!!!

[wecoyote5]

Hi James,

Here is what was on the /debug page. Do you want/need the docker logs?

NOTE: I haven't tried 6.7.2 yet, though.
FF III error 419.log

Thanks again for a great app!
Mark

[jaydee67]

Hi,

I updated just now and see the same.

Cheers

[zeno979]

Hi,
same problem here, running on container, app is accessed at http://192.168.0.8:65080, important log info are:

10.89.1.26 - - [17/Sep/2026:08:34:57 +0200] "GET /api/v1/summary/basic?start=2026-10-01&end=2026-10-31 HTTP/1.1" 499 0 "http://192.168.0.8:65080/" "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0" "-"
[2026-09-17 08:34:57] production.ERROR: CSRF token mismatch.  
10.89.1.26 - - [17/Sep/2026:08:34:57 +0200] "POST /daterange?redirect=true HTTP/1.1" 419 6605 "http://192.168.0.8:65080/" "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0" "-"

and env is set as:

PHP_SESSION_COOKIE_SECURE=false
COOKIE_PATH="/"
COOKIE_SAMESITE=lax
APP_URL=http://192.168.0.8:65080
COOKIE_SECURE=false
TRUSTED_PROXIES=**
SESSION_DRIVER=file
COOKIE_DOMAIN=

[zeno979]

using codex :-O i found that form generated in resources/views/layout/v3/session.blade.php is lacking of csrf fields in request.
Adding @csrf to the form fixes the problem immediately:

 <form action="{{ route('daterange') }}?redirect=true" method="POST" id="daterange-form">
+    @csrf
     <input type="hidden" name="start" value="" id="customStart"/>
     <input type="hidden" name="end" value="" id="customEnd"/>

After clearing the compiled views:

php artisan view:clear

the custom date range works normally

[JC5]

Excellent find! I will pick up the work later today :)

[JC5]

The suggested fix is live and this will be fixed in the next release.

[secqyl-alt]

hi,Version v6.7.2 also has this problem

[wecoyote5]

Great news, thanks!