Laravel project within iframe - CSRF token mismatch

Question

I have a project where I implemented Sanctum to be used as authentication for api calls. This is the way I use it

axios.get('/sanctum/csrf-cookie').then(response => {
   axios.post('/api/login', {data: data})
   .then(response => {
     ...
   })
   .catch(error => {
     ...
   });
});

When I run this as a standalone page, everything works fine. But once I try to use the same url with the same data in an iframe within another project, I get a CSRF token mismatch. error. Any guidance would be much appreciated.

@SamuelFerdary yes, I saw that one but I'm concerned as to what security threats the provided solution opens? Also, it is not a submission between different domains, everything is happening on the same site/domain. — Matrix
– Matrix, Commented Jan 6, 2022 at 6:49

Samuel Ferdary · Accepted Answer · 2022-01-07 06:15:12Z

4

iframe usage and security is use case dependent.

Security wise:

If you care about security, don't use iframes.

See:

StackExchange: What are the security implications of having login dialog inside of an iframe

Disable CSRF on specified endpoints:

If you have specific routes that don't need CSRF protection than you can make an exception for these routes in Http/Middleware/VerifyCsrfToken.php

See:

StackOverflow: Laravel 5 TokenMismatchException only in iFrame

Go all in on iframe support:

You can edit the session settings in config/session.php

See:

StackOverflow: Laravel 5.1 CSRF in iframe, how to make it work?

answered Jan 7, 2022 at 6:15

Samuel Ferdary

3242 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Matrix Over a year ago

That page within iframe is not used for traditional user login. User actually logs in in the host application and then passes a token to the iframe by which user is identified on the application within iframe. I don't really want to disable csrf check. Playing around with session config might be a step to the right direction

WebDev-SysAdmin · Accepted Answer · 2022-10-11 16:08:35Z

3

Go into config/session.php, and change this:

'secure' => env('SESSION_SECURE_COOKIE', true)

'same_site' => 'none',

Also, check your .env file for the value set for SESSION_SECURE_COOKIE, if it is set to false in the .env file then change it to true.

answered Oct 11, 2022 at 16:08

WebDev-SysAdmin

3694 silver badges12 bronze badges

Collectives™ on Stack Overflow

Laravel project within iframe - CSRF token mismatch

2 Answers 2

iframe usage and security is use case dependent.

Security wise:

Disable CSRF on specified endpoints:

Go all in on iframe support:

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

iframe usage and security is use case dependent.

Security wise:

Disable CSRF on specified endpoints:

Go all in on iframe support:

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related