Question 207572 in Laravel Question posted in
The official Laravel Documentation can be found here.

Laravel Sanctum CSRF Protection

So I am trying to configure Sanctum so that I would have CSRF protection for my API routes so that only my SPA’s frontend would be able to make requests to it.

After following the documentation and doing the instructions in in this part of the documentation. I still don’t thing that I have the CSRF protection properly set up.

I know this since I was able to make a request to routes under the auth:sanctum middleware such as the following route.

use IlluminateHttpRequest;
 
Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});

I am able to make a request using Post Man to my login route without the XSRF-Token and it is returning a response which concerns me as I expect to encounter a CSRF Token Mismatch exception or anything similar to that but I am receiving no such errors.

Am I misunderstanding something or just haven’t configured Sanctum properly?

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Turns out I had my sanctum misconfigured and had to reconfigure it and place the authorization routes to web.php.


  2. 0

    Use it in your appHttp|Kernal.php file,

    'api' => [
LaravelSanctumHttpMiddlewareEnsureFrontendRequestsAreStateful::class,
],

    I hope this will help.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search