title: Laravel API not working without CSRF token (and Headers globally messing around with me)
body: <p>I am trying to setup an API in my Laravel project, which I would like to consume with Javascript in my own project. The API is stateless, thus my understanding was that CRSF tokens become irrelevant when requesting the API. I am encountering the two following issues:</p>
  
  <ol>
  <li><p>when I try sending requests without the X-CSRF-TOKEN header, I get 401 Unauthorized</p></li>
  <li><p>there seem to be a problem with the headers not being properly applied to the response</p></li>
  </ol>
  
  <p>The requests are made from subdomain client.site.test to subdomain api.site.test . I have made sure CORS is authorized by applying an "InternalCORS" middleware to my API routes.</p>
  
  <p><em>Middleware - applied to all API routes</em></p>
  
  <pre><code>class InternalCors {
      public function handle($request, Closure $next) {
          header('Access-Control-Allow-Origin:  https://client.site.test');
          header('Access-Control-Allow-Headers:  Content-Type, X-Auth-Token, X-CSRF-Token, X-Requested-With, Authorization, Origin');
          header('Access-Control-Allow-Methods:  GET, POST, PUT');
          header('Access-Control-Allow-Credentials: true');
          return $next($request);
      }
  }
  </code></pre>
  
  <p><em>API routes</em></p>
  
  <pre><code>Route::middleware('auth:api')-&gt;get('/testApi', function (Request $request) {
      return response()-&gt;json($request-&gt;user()-&gt;fullName(), 200);
  })-&gt;name('testApi');
  </code></pre>
  
  <p><em>Ajax query</em></p>
  
  <pre><code>window.$.ajax({
      headers: {
          'Accept': 'application/json',
          'X-Requested-With': 'XMLHttpRequest'
      },
      xhrFields: {
         withCredentials: true
      },
      type: 'GET',
      url: 'https://api.site.test/testApi',
      success: function (response) {
          console.log(response);
      },
      error: function (xhr) {
          console.error(xhr.responseText);
      }
  });
  </code></pre>
  
  <p>Now, <em>even</em> with the middleware explicitely authorizing "Credentials", I was getting a response saying that the header is set not '' instead of 'true'. So I added on top an Nginx directive:</p>
  
  <pre><code>add_header Access-Control-Allow-Credentials "true";
  </code></pre>
  
  <p>With settings above, the response to the request is "401 Unauthorized". I have doubled checked that the VerifyCsrfToken middleware is only included by default in <em>web</em> routes, not <em>api</em>.</p>
  
  <p>I would like to able to say that adding the CRSF token to the ajax query solves the issue, <strong>but</strong> it's not that simple.. <strong>There are 3 headers that seem to affect the response I get</strong> :</p>
  
  <p>[CSRF]: whether I send a X-CSRF-TOKEN header in the Ajax request</p>
  
  <p>[MIDD HEADER]: whether I include <code>header('Access-Control-Allow-Credentials: true');</code> in the middleware for API routes</p>
  
  <p>[NGINX HEADER]: whether I include <code>add_header Access-Control-Allow-Credentials "true";</code> in my server configuration for API routes</p>
  
  <p><strong>Here is a recap of the response to Ajax query, depending on the headers set:</strong></p>
  
  <p>[CSRF] [MIDD HEADER] <del>[NGINX HEADER]</del> : <code>value of the 'Access-Control-Allow-Credentials' header in the response is ''</code></p>
  
  <p>[CSRF] [MIDD HEADER] [NGINX HEADER] : <code>value of the 'Access-Control-Allow-Credentials' header in the response is 'true, true'</code></p>
  
  <p>[CSRF] <del>[MIDD HEADER]</del> [NGINX HEADER] : <code>200 - John Smith</code></p>
  
  <p><del>[CSRF]</del> [MIDD HEADER] <del>[NGINX HEADER]</del> : <code>value of the 'Access-Control-Allow-Credentials' header in the response is ''</code></p>
  
  <p><del>[CSRF]</del> [MIDD HEADER] [NGINX HEADER] : <code>401 Unauthorized</code></p>
  
  <p><del>[CSRF]</del> <del>[MIDD HEADER]</del> [NGINX HEADER] : <code>value of the 'Access-Control-Allow-Credentials' header in the response is ''</code></p>
  
  <p>I'm at a loss here...</p>