One addition from a production incident where the 419 only hit a fraction of users: the manual checks in the diagnosis table don't help when you can't open the reporter's DevTools. What finally worked for us was a week of logging on TokenMismatchException: the route, whether the session cookie arrived at all, request()->isSecure(), and the Sec-Fetch-Site value. Every single entry came back as 'no session cookie present', which pointed straight at a SESSION_DOMAIN leftover from staging instead of a token problem. Just remember to rip the logging out once you've found it, you don't want session-adjacent detail sitting in your logs any longer than it needs to.