Laravel Sanctum is not giving out csrf-cookies, what should I do?

Question

Laravel

I am developing a bunch of sites site.ru (nuxt) and api.site.ru (Laravel 8 + Laravel Sanctum).
I made test authentication on site.ru. The request to get a csrf-cookie succeeds, but when it comes to api.site.ru/login it gives the following error with a 419 response:

CSRF token mismatch.

PS: For authentication I use the nuxt module Auth .

Here is my cors.php :

'paths' => [
        'api/*',
        'login',
        'logout',
        'sanctum/csrf-cookie'
    ],
    'allowed_methods' => ['*'],
    'allowed_origins' => ['*'],
    'allowed_origins_patterns' => [],
    'allowed_headers' => ['*'],
    'exposed_headers' => [],
    'max_age' => 0,
    'supports_credentials' => true,

nuxt.config.js :

axios: {
    baseUrl: process.env.API_URL,
    credentials: true,
  },

  auth: {
    strategies: {
      cookie: {
        cookie: {
          name: 'XSRF-TOKEN',
        }
      },
      'laravelSanctum': {
        provider: 'laravel/sanctum',
        url: process.env.API_URL
      },
    },
    redirect: {
      login: '/login',
      logout: '/logout',
      callback: '/login',
      home: '/'
    }
  },

Thanks in advance

Answer 1

csrf is not needed at all in this bundle