How to pass a CSRF token safely to a separate VueJS frontend?

Question

Laravel(backend) and VueJS(frontend created with Vue CLI) are separated, hence have different domains and repositories. I am wondering what is the best way to pass a CSRF token from Laravel to VueJS safely.

I've found some old questions here and on Laracasts but they are either irrelevant, outdated or have no answer. Here are a few:

Pass csrf token from Laravel to Vue

Creating a sign up token for Laravel app from separate frontend app

(Laracasts forum) CSRF in separate angular app

I am aware that Laravel ships with $except array in VerifyCSRFToken middleware. Adding frontend's URL to this list will create a security flaw, am I correct?

You need to add <meta> of CSRF in the index page and add the CSRF in each ajax call ! — Maraboc
– Maraboc, Commented Dec 18, 2019 at 10:11
@Maraboc I've mentioned that Laravel does not generate any view in this case, so I can't parse meta tag. I have a completely separate, standalone Vue instance. — Andrii H.
– Andrii H., Commented Dec 18, 2019 at 10:14
@Maraboc that is how laravel does it if you don't separate frontend from backend. When separated, it makes no sense to store it in HTML. Andrii: for SPAs, you shouldnt use sessions for authentication but rather JWT authentication, e.g. with Laravel Passport. If you don't use sessions anymore, your CSRF token becomes obsolete. — Matthias S
– Matthias S, Commented Dec 18, 2019 at 10:23
@MatthiasS makes sense, now I get it. I think this should be an answer to my question. Feel free to post it. — Andrii H.
– Andrii H., Commented Dec 18, 2019 at 15:14

Maraboc · Accepted Answer · 2019-12-19 15:33:18Z

2

In case of using a standalone application (vue, react, angular ....) the best solution is to use Laravel Passport instead of using CSRF tokens.

answered Dec 19, 2019 at 15:33

Maraboc

11.1k3 gold badges43 silver badges51 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to pass a CSRF token safely to a separate VueJS frontend?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related