A bit more snooping around uncovered that the AJAX eval () preview script wasn’t secured by a CSRF token which could easily be exploited by a malicious hacker.

Token Generation Behavior: When I load my application for the first time, a GET request is made, and a _csrfSecret is stored in the cookies. When I navigate to pages/first-page, a new CSRF token is ...

So I don't see why a CSRF token mismatch would be thrown. Worth noting, i was running Laravel 11 on the same three installs and wasn't experiencing this issue there, only since updating to Laravel 12 ...

Take advantage of anti-forgery tokens in ASP.NET Core to protect users of your applications against cross site request forgery exploits.