CODEWITHSUNDEEP
phplaravellaravel-sanctum
osama Abdullah
osama Abdullah

Reputation: 321

cookies are not set if you send request from different domain

I put all following in my .env file

COOKIE_SAME_SITE_POLICY=strict
SESSION_SECURE_COOKIE=false
SESSION_DOMAIN='.127.0.0.1'
SANCTUM_STATEFUL_DOMAINS='.localhost,.localhost:3000,127.0.0.1,127.0.0.1:8000,::1'

When I'm trying to authenticate from a different domain it gives 419 error CSRF token mismatch, the first request "http://127.0.0.1:8000/sanctum/csrf-cookie" which must set the cookies does not set anything however if I try the same request inside laravel instance it sets the cookies and works as expected

how every the same request sets the cookies successfully in postman

Steps To Reproduce:

  1. install laravel "composer create-project laravel/laravel sanctum"
  2. change 'supports_credentials' => false, to 'supports_credentials' => true, from /config/cors.php
  3. set up the vue app on "http://localhost:3000" and send a request to "http://127.0.0.1:8000/sanctum/csrf-cookie" and it will not set the cookies.

Upvotes: 0

Views: 838

Answers (1)

user15118945
user15118945

Reputation:

You cannot set a cookie for a different domain for security reasons

Upvotes: 1

Related Questions