title: Laravel Sanctum Auth issue
body: <p>I am having an issue with a sub domain and laravel sanctum. On the sub domain I am getting unauthorised. It is working just fine locally. </p>
  
  <p>I have added the domain to sanctum domain/.env. I have also setup the cors/config as per laravel documentation regarding sub domains and no luck. There is a Htpasswd on the site, could that be causing the issue? I am out of ideas :(.</p>
  
  <p>Has anyone experienced this before when using htpasswd? If you need some code please feel free to ask,</p>
  
  <p>EDIT*</p>
  
  <p>cors config</p>
  
  <pre><code>return [
  
      /*
      |--------------------------------------------------------------------------
      | Cross-Origin Resource Sharing (CORS) Configuration
      |--------------------------------------------------------------------------
      |
      | Here you may configure your settings for cross-origin resource sharing
      | or "CORS". This determines what cross-origin operations may execute
      | in web browsers. You are free to adjust these settings as needed.
      |
      | To learn more: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
      |
      */
  
      'paths' =&gt; ['api/*'],
  
      'allowed_methods' =&gt; ['*'],
  
      'allowed_origins' =&gt; ['*'],
  
      'allowed_origins_patterns' =&gt; [],
  
      'allowed_headers' =&gt; ['*'],
  
      'exposed_headers' =&gt; [],
  
      'max_age' =&gt; 0,
  
      'supports_credentials' =&gt; true,
  
  ];
  </code></pre>
  
  <p>sanctum config</p>
  
  <pre><code>return [
  
      /*
      |--------------------------------------------------------------------------
      | Stateful Domains
      |--------------------------------------------------------------------------
      |
      | Requests from the following domains / hosts will receive stateful API
      | authentication cookies. Typically, these should include your local
      | and production domains which access your API via a frontend SPA.
      |
      */
  
      'stateful' =&gt; explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost,127.0.0.1')),
  
      /*
      |--------------------------------------------------------------------------
      | Expiration Minutes
      |--------------------------------------------------------------------------
      |
      | This value controls the number of minutes until an issued token will be
      | considered expired. If this value is null, personal access tokens do
      | not expire. This won't tweak the lifetime of first-party sessions.
      |
      */
  
      'expiration' =&gt; null,
  
      /*
      |--------------------------------------------------------------------------
      | Sanctum Middleware
      |--------------------------------------------------------------------------
      |
      | When authenticating your first-party SPA with Sanctum you may need to
      | customize some of the middleware Sanctum uses while processing the
      | request. You may change the middleware listed below as required.
      |
      */
  
      'middleware' =&gt; [
          'verify_csrf_token' =&gt; App\Http\Middleware\VerifyCsrfToken::class,
          'encrypt_cookies' =&gt; App\Http\Middleware\EncryptCookies::class,
      ],
  
  ];
  </code></pre>
  
  <p>.env</p>
  
  <pre><code>APP_NAME="Events"
  APP_ENV=local
  APP_KEY=base64:COUzIB3fLtC9H7VYX4UdQAx8I2V7Hq9BoeJNjPATwMM=
  APP_DEBUG=true
  APP_URL=http://events.hiddendomain.com
  
  LOG_CHANNEL=stack
  
  DB_CONNECTION=mysql
  DB_HOST=127.0.0.1
  DB_PORT=3306
  DB_DATABASE=hiddenname
  DB_USERNAME=hiddenuser
  DB_PASSWORD=hiddenpw
  
  BROADCAST_DRIVER=log
  CACHE_DRIVER=file
  QUEUE_CONNECTION=sync
  SESSION_DRIVER=cookie
  SESSION_LIFETIME=120
  SESSION_DOMAIN='.hiddendomain.com'
  SANCTUM_STATEFUL_DOMAIN="events.hiddendomain.com"
  
  REDIS_HOST=127.0.0.1
  REDIS_PASSWORD=null
  REDIS_PORT=6379
  
  MAIL_MAILER=smtp
  MAIL_HOST=smtp.mailtrap.io
  MAIL_PORT=2525
  MAIL_USERNAME=null
  MAIL_PASSWORD=null
  MAIL_ENCRYPTION=null
  MAIL_FROM_ADDRESS=null
  MAIL_FROM_NAME="${APP_NAME}"
  
  AWS_ACCESS_KEY_ID=
  AWS_SECRET_ACCESS_KEY=
  AWS_DEFAULT_REGION=us-east-1
  AWS_BUCKET=
  
  PUSHER_APP_ID=
  PUSHER_APP_KEY=
  PUSHER_APP_SECRET=
  PUSHER_APP_CLUSTER=mt1
  
  MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
  MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
  </code></pre>
  
  <p>Iv'e add this to axios</p>
  
  <pre><code>axios.defaults.withCredentials = true;
  </code></pre>
  
  <p>Vue call</p>
  
  <pre><code>getEventDays() {
  axios.get(`/api/event/${this.eventSlug}/${this.slugify(this.selectedAgendaType)}/get-days`)
   .then((res) =&gt; {
   // Set the days
   this.days = res.data.data;
   // set the selected day to the day id
   this.selectedDay = res.data.data[0].id;
   // get the sessions for the day(selectedDay) e.g api call
   this.getDayWithSessions();
   })
   .catch((err) =&gt; console.error(err.response || err));
  },
  </code></pre>
  
  <p>I have removed the domain name as I can't reveal the name but the principle will be the same. </p>
  
  <p>People have asked for code however there isn't much to sanctum. The site isn't a full SPA. Im just using a vue component in blade view.</p>
  
  <p>UPDATE</p>
  
  <p>I have since removed the htpasswd and I still have the issue. I have possible 30 different sites and everything is the same on every site and with no luck on getting it to work on a sub domain</p>
  
  <p>UPDATE</p>
  
  <p>I have since replicated this on my localhost by using valet and setting up a sub domain. The exact same issue occurs!</p>
  
  <p>Thanks all in advance.</p>