title: Laravel Sanctum with Angular SPA on same TLD issues with XSRF-TOKEN
body: <p>The Angular app does not always set the XSRF-TOKEN when making POST request to the Laravel server. The issue is that I know how to make the app not work I just can not figure out how to make it work properly without tricking it.</p>
  <p>Angular is running on idleave.net
  Laravel is running on api.idleave.net</p>
  <p>All of this is in a virtual host with the host machine with a properly configured hosts file.</p>
  <p>Method to cause the app not to work properly:
  Open new Incognito window and type in the idleave.net url. Click to login enter the proper email and password and the POST to the Laravel app at api.idleave.net will respond with
  &quot;CSRF token mismatch.&quot;</p>
  <p>Method to cause the app to work properly:
  Open new Incognito window and even a new tab in the Incognito window described above and type in the url for the Laravel app, api.idleave.net to get to the default Laravel landing page. Return to window where CSRF token mismatch. occurred and hit the login button again and there are no problems the XSRF-TOKEN is attached to the Request Header.</p>
  <p>This gives the impression that I have to touch the api.idleaave.net before things will work properly.</p>
  <p>When making the request in the improper method I can see that return from the GET to the api.idleave.net/sanctum/csrf-cookie has a response header of Set-Cookie: XSRF-TOKEN= but my http-interceptor using HttpXsrfTokenExtractor::getToken() returns null but with the proper method it does get the token.</p>
  <p>Once I have touched the api.idleave.net url in any of the Incognito windows I have then all things work properly in all windows. If I close all incognito windows then open a new incognito windows then things will not work until I have opened an incognito window to the api.idleave.net url.</p>
  <p>I am not even sure how to ask the question to determine the cause of this situation.</p>
  <p>This is running on Ubuntu with Nginx as the</p>