title: Laravel Sanctum XSRF-TOKEN Cookie not Getting Sent
body: <p>I'm using Laravel 8 and I've been trying to follow the sanctum documentation for <a href="https://laravel.com/docs/8.x/sanctum#spa-authentication" rel="nofollow noreferrer">SPA authentication</a>. I've already done setting up the necessary configurations required. The backend server is running on localhost with default port(80) while SPA client is running on localhost:3000. I'm using nuxt framework for client with axios to make a request.</p>
  <p>The initial request should be made to /sanctum/csrf-cookie to initialize the CSRF protection cookie and here's what network traffic traffic shows</p>
  <p><a href="https://i.stack.imgur.com/R7WNX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/R7WNX.png" alt="enter image description here" /></a></p>
  <p>The second request is the actual request that should contain the cookies sent by the first request for the domain but it looks like the XSRF-TOKEN is being skipped. Here's what network traffic looks like</p>
  <p><a href="https://i.stack.imgur.com/jsXz2.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jsXz2.png" alt="enter image description here" /></a></p>
  <p>sanctum.php config file:</p>
  <pre><code>&lt;?php
  return [
      'stateful' =&gt; explode(',', env(
          'SANCTUM_STATEFUL_DOMAINS',
          'localhost,localhost:3000,127.0.0.1,127.0.0.1:8000,::1'
      )),
      'expiration' =&gt; null,
      'middleware' =&gt; [
          'verify_csrf_token' =&gt; App\Http\Middleware\VerifyCsrfToken::class,
          'encrypt_cookies' =&gt; App\Http\Middleware\EncryptCookies::class,
      ],
  ];
  </code></pre>
  <p>cors.php config file:</p>
  <pre><code>&lt;?php
  return [
      'paths' =&gt; ['api/*', 'sanctum/csrf-cookie'],
      'allowed_methods' =&gt; ['*'],
      'allowed_origins' =&gt; ['*', 'localhost:3000'],
      'allowed_origins_patterns' =&gt; [],
      'allowed_headers' =&gt; ['*'],
      'exposed_headers' =&gt; ['XSRF-TOKEN', 'X-XSRF-TOKEN'],
      'max_age' =&gt; 0,
      'supports_credentials' =&gt; true,
  ];
  </code></pre>
  <p>session.php config file</p>
  <pre><code>&lt;?php
  
  use Illuminate\Support\Str;
  
  return [
      'driver' =&gt; env('SESSION_DRIVER', 'file'),
      'lifetime' =&gt; env('SESSION_LIFETIME', 120),
      'expire_on_close' =&gt; false,
      'encrypt' =&gt; false,
      'files' =&gt; storage_path('framework/sessions'),
      'connection' =&gt; env('SESSION_CONNECTION', null),
      'table' =&gt; 'sessions',
      'store' =&gt; env('SESSION_STORE', null),
      'lottery' =&gt; [2, 100],
      'cookie' =&gt; env(
          'SESSION_COOKIE',
          Str::slug(env('APP_NAME', 'laravel'), '_').'_session'
      ),
      'path' =&gt; '/',
      'domain' =&gt; env('SESSION_DOMAIN', null),
      'secure' =&gt; env('SESSION_SECURE_COOKIE'),
      'http_only' =&gt; true,
      'same_site' =&gt; 'lax',
  ];
  </code></pre>
  <p>I set this in nuxt.config.js</p>
  <pre><code>export default {
    axios: {
      withCredentials: true,
      baseURL: 'http://localhost/',
    },
  }
  </code></pre>
  <p>Can somebody tell me why the XSRF-TOKEN cookie is not getting sent back?</p>
  <p>Thanks</p>