title: CSRF protection not working in Laravel + Sanctum rest api
body: <p>I am creating authorization in SPA,</p>
  <p>On the server - Laravel + sanctum</p>
  <p>On the client - Vue + Axios</p>
  <p>I want to make protection against CSRF, for this I installed the Sanctum package</p>
  <p>in <code>app/Http/Kernel.php</code> file added Middleware</p>
  <pre><code>'api' =&gt; [
      EnsureFrontendRequestsAreStateful::class,
      'throttle:api',
      \Illuminate\Routing\Middleware\SubstituteBindings::class,
  ],
  </code></pre>
  <p>in <code>routes/api.php</code> file</p>
  <p>created route <code>Route::post ('/register', [AuthController::class, 'register']);</code></p>
  <p>in the controller I added a simple validate with registration</p>
  <pre><code>public function register(Request $request)
  {
      
      $request-&gt;validate([
          'name'     =&gt; 'required|string',
          'email'    =&gt; 'required|email:rfc,dns|string|unique:users,email',
          'password' =&gt; 'required|string|confirmed',
      ]);
      
      $user = User::create([
          'name'     =&gt; $request-&gt;name,
          'email'    =&gt; $request-&gt;email,
          'password' =&gt; bcrypt($request-&gt;password),
      ]);
      
  }
  </code></pre>
  <p>After I submit the form, the data is seamlessly added to the database and User created.</p>
  <p>Although Sanctum suggests that in addition I have to send cookies with <code>XSRF-TOKEN</code>. Otherwise, an error should be returned to me that there is no CSRF token with http status 419.</p>
  <p>But there is no error and data is added</p>
  <p>There are no saved cookies in the browser, I checked, cleaned, opened in incognito, tried sending requests through Postman</p>
  <p>I want to see this error, but I am not getting it</p>
  <p>Tell me what is missing?</p>