Sanctum 3.2.4 causes CSRF token mismatch error

[sts-ryan-holton]

Sanctum Version

3.2.4

Laravel Version

10.9.0

PHP Version

8.1.13

Database Driver & Version

MySQL 8.x

Description

After upgrading from 3.2.3 to 3.2.4 and making no configuration changes to my project, making POST requests to my API endpoints throws a "CSRF token mismatch." error. When simply downgrading back to 3.2.3 everything works as intended.

It's noted that I'm working on localhost.

It looks like this function in a recent change is responsible, and after some debugging of it myself, the returned $domain value appears to be giving the following value when working on localhost:

"localhost/"

Note the trailing slash. I think this is causing something to break in validating the token since my SESSION_DOMAIN value is just "localhost".

Error...

{
    "message": "CSRF token mismatch.",
    "exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException",
    "file": "/Users/ryanholton/Sites/bume-project/bume-api/vendor/laravel/framework/src/Illuminate/Foundation/Exceptions/Handler.php",
    "line": 413,
}

Steps To Reproduce

1. Upgrade from 3.2.3 to 3.2.4
2. Keep host variable set as "localhost"

Additional context

Weirdly, on 3.2.4 the token mismatch error was only ever thrown on POST requests to the store action. GET requesst to other actions continued to work.

For now I've downgraded a version.

There's no notes listed in the upgrade file.

[Mishanki]

I have same problem witn Laravel 10 REST API.
REST API is stateless.

How to resolve problem?
Exclude DOMAIN from stateful list.

'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', sprintf(
      '%s%s',
      'localhost,localhost:3000,127.0.0.1,127.0.0.1:8000,::1',
      Sanctum::currentApplicationUrlWithPort()
)))

In .env define SANCTUM_STATEFUL_DOMAINS with empty domain.

[taylorotwell]

Please try 3.2.5.

[sts-ryan-holton]

I've just updated to 3.2.5 and appears to be working on first glance. I'd like to keep this issue open for a few days for observations.

@taylorotwell What does the newest changes around middleware solve? We've noticed several implementations and rollbacks recently on this - just curious what this change is?

[driesvints]

@sts-ryan-holton thanks for confirming that. If it solves your issue then there's no reason to keep this open.

[rocalex]

I have same problem.
I'm calling API from next.js app.

Frontend: http://localhost:3000
Backend: https://api.barren.cn

How to solve this problem?

[rocalex]

[rocalex]

{
    "message": "CSRF token mismatch.",
    "exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException",
    "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Exceptions/Handler.php",
    "line": 396,
    "trace": [
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Exceptions/Handler.php",
            "line": 367,
            "function": "prepareException",
            "class": "Illuminate\\Foundation\\Exceptions\\Handler",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php",
            "line": 51,
            "function": "render",
            "class": "Illuminate\\Foundation\\Exceptions\\Handler",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 185,
            "function": "handleException",
            "class": "Illuminate\\Routing\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php",
            "line": 121,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php",
            "line": 64,
            "function": "handleStatefulRequest",
            "class": "Illuminate\\Session\\Middleware\\StartSession",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Session\\Middleware\\StartSession",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php",
            "line": 37,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php",
            "line": 67,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Cookie\\Middleware\\EncryptCookies",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/sanctum/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php",
            "line": 60,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 162,
            "function": "Laravel\\Sanctum\\Http\\Middleware\\{closure}",
            "class": "Laravel\\Sanctum\\Http\\Middleware\\EnsureFrontendRequestsAreStateful",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 116,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/sanctum/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php",
            "line": 24,
            "function": "then",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Laravel\\Sanctum\\Http\\Middleware\\EnsureFrontendRequestsAreStateful",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 116,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
            "line": 797,
            "function": "then",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
            "line": 776,
            "function": "runRouteWithinStack",
            "class": "Illuminate\\Routing\\Router",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
            "line": 740,
            "function": "runRoute",
            "class": "Illuminate\\Routing\\Router",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
            "line": 729,
            "function": "dispatchToRoute",
            "class": "Illuminate\\Routing\\Router",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php",
            "line": 190,
            "function": "dispatch",
            "class": "Illuminate\\Routing\\Router",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 141,
            "function": "Illuminate\\Foundation\\Http\\{closure}",
            "class": "Illuminate\\Foundation\\Http\\Kernel",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php",
            "line": 21,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php",
            "line": 31,
            "function": "handle",
            "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Foundation\\Http\\Middleware\\ConvertEmptyStringsToNull",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php",
            "line": 21,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php",
            "line": 40,
            "function": "handle",
            "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Foundation\\Http\\Middleware\\TrimStrings",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php",
            "line": 27,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php",
            "line": 86,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Http/Middleware/HandleCors.php",
            "line": 62,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Http\\Middleware\\HandleCors",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php",
            "line": 39,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 180,
            "function": "handle",
            "class": "Illuminate\\Http\\Middleware\\TrustProxies",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
            "line": 116,
            "function": "Illuminate\\Pipeline\\{closure}",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php",
            "line": 165,
            "function": "then",
            "class": "Illuminate\\Pipeline\\Pipeline",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php",
            "line": 134,
            "function": "sendRequestThroughRouter",
            "class": "Illuminate\\Foundation\\Http\\Kernel",
            "type": "->"
        },
        {
            "file": "/Volumes/DATA/SourceCode/barren/backend/public/index.php",
            "line": 51,
            "function": "handle",
            "class": "Illuminate\\Foundation\\Http\\Kernel",
            "type": "->"
        }
    ]
}