unserialize(): Error at offset 0 of 40 bytes Error

Question

I Want to run my application in localhost with php artisan serve but I get this Error unserialize(): Error at offset 0 of 40 bytes where is my problem?

Answer 1

You have to set a news Key Generate because

php artisan key:generate

After that test again to run the Laravel Application

php artisan serve

Answer 2

I got the same error, when I upgrade a Laravel 5.5 app to 5.6. The error comes form the EncryptCookies-Middleware.

Delete the cookies in your browser and/or clear your session-files in your Laravel app.

Answer 3

I've faced same problem. I frequently faced this problem in Homestead-vagrant environment. To solve this issue in Laravel 5.4,5.5,5.6 or more -

php artisan config:clear

php artisan view:clear

php artisan key:generate

Answer 4

I got the same error a couple of days ago when I pushed a production update to my Laravel project from Envoyer.

Immediate fix: I tried to rollback to the previous commit but the issue persisted which means the issue was originating from the client side, cookies probably. I tried removing cookies and the issue was gone.

Later, I spent a lot of time looking for this issue but got nothing until I faced this issue again today with another deployment and i found this article on Laravel news about the security fix 5.6.30 update. I was able to identify that this issue occurs if i try to deploy previous (< 5.6.30) version of the laravel v5.6.26 for a project which was already using > v5.6.30 and cookies were already created ( not serliazed) which when <5.6.30 version of the framework tries to unserlize results in error because they're not properly serealized.

• Installing laravel/framework (v5.6.26) Loading from cache

From the upgrade guide:

Configuring Cookie Serialization Since this vulnerability is not able to be exploited without access to your application's encryption key, we have chosen to provide a way to re-enable encrypted cookie serialization while you make your application compatible with these changes. To enable / disable cookie serialization, you may change the static serialize property of the App\Http\Middleware\EncryptCookies middleware:

I was able to fix this issue permanently by clearing cache of composer so forcing it to load latest version of the framework instead of falling back to cache.

Hope this helps.

Bests,

Answer 5

Just Inspect the element in Browser, and go to application tab and select cookie and delete that all cookie. That's It.

Answer 6

In App\Exceptions\Handler under render function use this snippet, it will reset browser cookie.

if (str_contains($exception->getMessage(), 'unserialize')) {
    $cookie1 = \Cookie::forget('laravel_session');
    $cookie2 = \Cookie::forget('XSRF-TOKEN');

    return redirect()->to('/')
                 ->withCookie($cookie1)
                 ->withCookie($cookie2);
}

Answer 7

In my case I did removed my composer.lock and did a composer install and voila...

$ cd project_root
$ rm composer.lock
$ composer install

Answer 8

In my case, I was trying to decrypt a hash with an wrong function.

I was creating encrypt using encryptString()

$hash = Crypt::encryptString('secret');

but I tried to decrypt using decrypt()

$value = Crypt::decrypt($hash);

the correct way is

$value = Crypt::decryptString($hash);

So when you encrypt using Crypt::encrypt() you must decrypt it using Crypt::decrypt(), and for Crypt::encryptString() use Crypt::decryptString()

Answer 9

I also encountered this issue when I happened to update my composer. If you put

protected static $serialize = true;

inside App\Http\Middleware\EncryptCookies, the old cookie will break your system. So to prevent this, either you have to clear the cookie, or just don't unserialize the decrypted cookie.

I made a workaround for this: Inside vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php Above this line of decrypt() function:

return $unserialize ? unserialize($decrypted) : $decrypted;

add:

try {
            return $unserialize ? unserialize($decrypted) : $decrypted;
        } catch (\Exception $e){
            return $decrypted;
        }

This might be ugly, but you can temporarily put it there until you think the old cookies has gone.

Answer 10

The first thing you should do is clear the configuration cache file

php artisan config:clear

Then create a new key for the application

php artisan key:generate

Finally, restart the server.. I hope it will fix your problem.

Answer 11

In my case happened during local development. The steps that caused the problem was:

1. I upgraded the laravel up to 5.8 on a seperate branch.
2. I switched into an another branch having laravel 5.2 (in my case I had to review a PR)

I also was logged in in my app and hence there was a session cookie as well. In that case I just cleared the browser's cookies and got fresh ones.

In firefox can be done via visiting then select about:preferences#privacy and select the appropriate option. as the following images show (in Greek)

Privacy setting and an indication where the user to click

An anothwer aproach to diagnose the issue it to open a private firefox window or use chrome's cognito mode.

Answer 12

In my case, it was related to route cache

php artisan route:clear

Answer 13

yeah, for localhost you can just delete cookies, but for production put this in your error handler so users would not see whoops :

if (strpos($exception->getMessage(), 'unserialize(): Error at offset 0 of 40 bytes') === 0) {
    unset($_COOKIE['laravel_session']);
    unset($_COOKIE['XSRF-TOKEN']);

    setcookie('laravel_session', null, -1, '/');
    setcookie('XSRF-TOKEN', null, -1, '/');

    abort(200, '', ['Location' => route('frontend.home')]);
}

PS. tested for laravel 5.6.

Answer 14

you will just run in terminal

composer global update