From f4d46f5d5388280e5338316198f37cbb041dde44 Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:36:12 +0900 Subject: [PATCH 1/4] fix: enable supports_credentials in CORS config for Sanctum cookie auth --- src/config/cors.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/config/cors.php b/src/config/cors.php index 2de0729..3f96e5b 100644 --- a/src/config/cors.php +++ b/src/config/cors.php @@ -12,5 +12,5 @@ 'allowed_headers' => ['*'], 'exposed_headers' => [], 'max_age' => 0, - 'supports_credentials' => false, + 'supports_credentials' => true, ]; \ No newline at end of file From 540c5cc1e83937e2931d362b833f2aaea9dd70a4 Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:38:46 +0900 Subject: [PATCH 2/4] docs: explain why supports_credentials must be true for Sanctum SPA auth --- src/config/cors.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/config/cors.php b/src/config/cors.php index 3f96e5b..8a90c97 100644 --- a/src/config/cors.php +++ b/src/config/cors.php @@ -12,5 +12,11 @@ 'allowed_headers' => ['*'], 'exposed_headers' => [], 'max_age' => 0, + + // Sanctum's cookie-based SPA auth sends requests with `credentials: 'include'`. + // If this is false, the browser will discard the session cookie on cross-origin + // responses even though the cookie itself was issued successfully, so the + // frontend appears logged in but authenticated requests (e.g. fetching the + // current user) fail silently. 'supports_credentials' => true, ]; \ No newline at end of file From 432f17013acd5ec2252d6b3692d4351240fdb3af Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:39:22 +0900 Subject: [PATCH 3/4] fix: read frontend origin from FRONTEND_URL env var instead of hardcoding it --- src/config/cors.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/config/cors.php b/src/config/cors.php index 8a90c97..283dd6b 100644 --- a/src/config/cors.php +++ b/src/config/cors.php @@ -4,8 +4,7 @@ 'paths' => ['api/*', 'sanctum/csrf-cookie'], 'allowed_methods' => ['*'], 'allowed_origins' => [ - 'http://localhost:3876', - 'http://127.0.0.1:5173', + env('FRONTEND_URL', 'http://localhost:3876'), 'https://zigzagdev.github.io', ], 'allowed_origins_patterns' => [], From cc7f52f4b81c3360d25414b83ab59e61147e2598 Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:39:52 +0900 Subject: [PATCH 4/4] chore: document FRONTEND_URL in .env.example --- src/.env.example | 1 + 1 file changed, 1 insertion(+) diff --git a/src/.env.example b/src/.env.example index 6fb3de6..44fb3ea 100644 --- a/src/.env.example +++ b/src/.env.example @@ -4,6 +4,7 @@ APP_KEY= APP_DEBUG=true APP_TIMEZONE=UTC APP_URL=http://localhost +FRONTEND_URL=http://localhost:3876 APP_LOCALE=en APP_FALLBACK_LOCALE=en