From f4d46f5d5388280e5338316198f37cbb041dde44 Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:36:12 +0900 Subject: [PATCH 1/5] fix: enable supports_credentials in CORS config for Sanctum cookie auth --- src/config/cors.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/config/cors.php b/src/config/cors.php index 2de0729..3f96e5b 100644 --- a/src/config/cors.php +++ b/src/config/cors.php @@ -12,5 +12,5 @@ 'allowed_headers' => ['*'], 'exposed_headers' => [], 'max_age' => 0, - 'supports_credentials' => false, + 'supports_credentials' => true, ]; \ No newline at end of file From 540c5cc1e83937e2931d362b833f2aaea9dd70a4 Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:38:46 +0900 Subject: [PATCH 2/5] docs: explain why supports_credentials must be true for Sanctum SPA auth --- src/config/cors.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/config/cors.php b/src/config/cors.php index 3f96e5b..8a90c97 100644 --- a/src/config/cors.php +++ b/src/config/cors.php @@ -12,5 +12,11 @@ 'allowed_headers' => ['*'], 'exposed_headers' => [], 'max_age' => 0, + + // Sanctum's cookie-based SPA auth sends requests with `credentials: 'include'`. + // If this is false, the browser will discard the session cookie on cross-origin + // responses even though the cookie itself was issued successfully, so the + // frontend appears logged in but authenticated requests (e.g. fetching the + // current user) fail silently. 'supports_credentials' => true, ]; \ No newline at end of file From 432f17013acd5ec2252d6b3692d4351240fdb3af Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:39:22 +0900 Subject: [PATCH 3/5] fix: read frontend origin from FRONTEND_URL env var instead of hardcoding it --- src/config/cors.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/config/cors.php b/src/config/cors.php index 8a90c97..283dd6b 100644 --- a/src/config/cors.php +++ b/src/config/cors.php @@ -4,8 +4,7 @@ 'paths' => ['api/*', 'sanctum/csrf-cookie'], 'allowed_methods' => ['*'], 'allowed_origins' => [ - 'http://localhost:3876', - 'http://127.0.0.1:5173', + env('FRONTEND_URL', 'http://localhost:3876'), 'https://zigzagdev.github.io', ], 'allowed_origins_patterns' => [], From cc7f52f4b81c3360d25414b83ab59e61147e2598 Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 15:39:52 +0900 Subject: [PATCH 4/5] chore: document FRONTEND_URL in .env.example --- src/.env.example | 1 + 1 file changed, 1 insertion(+) diff --git a/src/.env.example b/src/.env.example index 6fb3de6..44fb3ea 100644 --- a/src/.env.example +++ b/src/.env.example @@ -4,6 +4,7 @@ APP_KEY= APP_DEBUG=true APP_TIMEZONE=UTC APP_URL=http://localhost +FRONTEND_URL=http://localhost:3876 APP_LOCALE=en APP_FALLBACK_LOCALE=en From 738404861b030532eefe6e4252bf0c01db0da1ea Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Mon, 20 Jul 2026 18:21:38 +0900 Subject: [PATCH 5/5] fix: include FRONTEND_URL host in SANCTUM_STATEFUL_DOMAINS --- src/config/sanctum.php | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/config/sanctum.php b/src/config/sanctum.php index ff9ca03..c96de92 100644 --- a/src/config/sanctum.php +++ b/src/config/sanctum.php @@ -5,6 +5,15 @@ use Laravel\Sanctum\Http\Middleware\AuthenticateSession; use Laravel\Sanctum\Sanctum; +$frontendUrl = env('FRONTEND_URL', 'http://localhost:3876'); +$frontendHost = parse_url($frontendUrl, PHP_URL_HOST); +$frontendPort = parse_url($frontendUrl, PHP_URL_PORT); + +// Sanctum only treats requests from a listed domain/host as cookie-based SPA +// requests; anything else falls back to requiring a bearer token. The frontend +// (FRONTEND_URL) must be listed here or its session cookie is never checked. +$frontendStatefulDomain = $frontendPort ? "{$frontendHost}:{$frontendPort}" : $frontendHost; + return [ /* @@ -19,8 +28,9 @@ */ 'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', sprintf( - '%s%s', + '%s,%s%s', 'localhost,localhost:3000,127.0.0.1,127.0.0.1:8000,::1', + $frontendStatefulDomain, Sanctum::currentApplicationUrlWithPort(), // Sanctum::currentRequestHost(), ))),