Laravel Sanctum - sanctum/csrf-cookie (204 "No content")

Question

Laravel sanctum has been a bit of a headache for me as i have spent hours trying to figure out why sanctum/csrf-cookie route returns no content. initially the same route return 404 not found but after adding 'prefix' => 'api/sanctum' config/sanctum.php it seems to work except that it outputs nothing and no cookie is set in my browser.

Here are some of my codes

.env

SANCTUM_STATEFUL_DOMAINS=localhost:8080
SPA_URL=http://localhost:8080
SESSION_DOMAIN=localhost

--config/cors.php

'paths' => [
        'api/*',
        'login',
        'logout',
        'register',
        'user/password',
        'forgot-password',
        'reset-password',
        'sanctum/csrf-cookie',
        'user/profile-information',
        'email/verification-notification',
      ],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,

axios

export const authClient = axios.create({
  baseURL: process.env.VUE_APP_API_URL,
  withCredentials: true, // required to handle the CSRF token
});

and having done all of that, if i tried to generate a token using

axios.get('/sanctum/csrf-cookie').then(response => {
    // Login...
});

i get 204 no content response i have also added the api middleware in kernel.php as instructed in the doucmentation but still wont set the cookie. and when i try to make request to another route protected by sanctum i 419 token mismatch. i have also run a fresh installation of laravel, php artisan optimize, cleared my brower history, checked the endpoints in postman but still thesame 204 and 419 exceptions

What is your VUE_APP_API_URL, is it localhost:8000?

Joseph Ajibodu
– Joseph Ajibodu

2022-05-13 23:07:24 +00:00
Commented May 13, 2022 at 23:07 — Joseph Ajibodu
– Joseph Ajibodu, Commented May 13, 2022 at 23:07

M't · Accepted Answer · 2021-09-27 10:06:24Z

7

I was struggling with the same issue for days and then founded a way that worked. so :

The '/sanctum/csrf-cookie' route return a 204 response when successfull, the then you have to send your post request with credentials. i used to get a 419 reponse status.

so after followed laravel docs here is what i added :

SPA make sure you set the withCredentials header to true
API

.env

SESSION_DRIVER=cookie
SESSION_DOMAIN='.localhost'
SANCTUM_STATEFUL_DOMAINS='localhost,127.0.0.1'

.kernel.php

add in your middleware array : \Illuminate\Session\Middleware\StartSession::class

answered Sep 27, 2021 at 10:06

M't

1962 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

mjmicro Over a year ago

It works, but needed to change '.localhost' to 'localhost' without '.' in front. Worked without StartSession::class in kernal.php api. Needed to uncomment EnsureFrontendRequestsAreStateful in kernal.php

Mr.Sha1 · Accepted Answer · 2022-04-05 20:41:31Z

1

Hey I don't know whether you've found the answer or not but that request meant to have empty response body. Your CSRF token is available in the header of the response ;D

answered Apr 5, 2022 at 20:41

Mr.Sha1

5401 gold badge3 silver badges19 bronze badges

Comments

dotrey · Accepted Answer · 2023-05-05 09:14:31Z

Note that the /sanctum/csrf-cookie route by default uses the middleware group web as defined by $middlewareGroups in \App\Http\Kernel.php.

Make sure that this middleware group contains \App\Http\Middleware\VerifyCsrfToken::class, because this is the middleware that actually sets the XSRF-TOKEN cookie.

If you are using a middleware group with a different name: You can't change the middleware used by the Sanctum route at the moment, so it is probably easiest to disable the default route by adding 'routes' => false to your config/sanctum.php file:

<?php

return [
   ...
   'routes' => false,
   ...
];

Then add a new route to your routes/web.php that doesn't have to return anything:

Route::get('/my/csrf', function(\Illuminate\Http\Request $request) {
    if ($request->expectsJson()) {
        return new JsonResponse(null, 204);
    }

    return new Response('', 204);
});

You should also place this route outside of any authentication, so it can be called before login.

verdery · Accepted Answer · 2021-12-24 15:55:24Z

0

From HTTP Specification:

The HTTP 204 No Content success status response code indicates that a request has succeeded, but that the client doesn't need to navigate away from its current page. This might be used, for example, when implementing "save and continue editing" functionality for a wiki site.

According to specification 204 is the exptected response from server.

answered Dec 24, 2021 at 15:55

verdery

5411 gold badge7 silver badges20 bronze badges

Comments

Anas El-Bharawy · Accepted Answer · 2023-01-19 19:23:02Z

0

You can insert in bootstrap.js file

import axios from 'axios';
window._ = _;


window.axios = axios;
window.axios.defaults.baseURL = "/api/";
window.axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';

answered Jan 19, 2023 at 19:23

Anas El-Bharawy

213 bronze badges

Comments

Chandan Bisht · Accepted Answer · 2023-08-06 05:50:32Z

0

I was also facing the same issue in my reactjs app, I fixed this issue by sending the following

axiosClient.defaults.withCredentials = true;

I hope this will help.

answered Aug 6, 2023 at 5:50

Chandan Bisht

533 bronze badges

Collectives™ on Stack Overflow

Laravel Sanctum - sanctum/csrf-cookie (204 "No content")

6 Answers 6

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related