0

I'm using postman to test the API i'm building in Laravel 10. Auth via Sanctum.

The weird thing is, in the documentation:

In addition, since your application already made a request to the /sanctum/csrf-cookie route, subsequent requests should automatically receive CSRF protection as long as your JavaScript HTTP client sends the value of the XSRF-TOKEN cookie in the X-XSRF-TOKEN header.

Of course, if your user's session expires due to lack of activity, subsequent requests to the Laravel application may receive 401 or 419 HTTP error response. In this case, you should redirect the user to your SPA's login page.

While for me, in postman (and in several answers I found on here and reddit) , it works like the following: Before login -> get new token (makes sense). Postman script saves token into variable, PM uses it in all headers.

When trying to logout - CSRF token mismatch..?

Same for post / patch. Weirdly, protected GET routes do work without the header.

I can make it work, just need to get the new token in the pre-script before any post / patch request.

I'm asking here for three reasons:

  1. Is this expected behaviour / safe code?
  2. Have I missed something in the documentation? It quite explicitly says I don't need to get a new token until it expires.
  3. Is this configured in laravel, common knowledge about tokens / cookies I don't know of or is laravel actually sending a new token that I need to set, just not required with GETs?

Sorry for the newb question, but I'd really like to understand what I'm creating not just mindlessly copying code that worked for someone else.

Thank you!

onemorecoffee
  • 1
  • 1
  • are you sure your routes use the `api` middleware and not `web`, passing the bearer token should be enough for any route – kris gjika Aug 16 '23 at 09:22
  • I'm not using a bearer-token (api key), but the CSRF auth method as linked above. And that's using the web.php initially, for reasons described in the docu. The rest (not auth) routes are defined and called on /api (api.php), using middleware auth:sanctum there too. Web.php is basically empty – onemorecoffee Aug 16 '23 at 10:44
  • are you including the CSRF token in the headers? – kris gjika Aug 16 '23 at 11:40
  • I am, but for the GET it worked without it. Now implementing it in ReactJS so there i can have another go at it. We'll see. – onemorecoffee Aug 16 '23 at 16:41

0 Answers0