fix: enable Sanctum SPA cookie auth for the frontend origin / フロントのオリジンに対するSanctum Cookie認証の有効化

src/.env.example

@@ -4,6 +4,7 @@ APP_KEY=
 APP_DEBUG=true
 APP_TIMEZONE=UTC
 APP_URL=http://localhost
+FRONTEND_URL=http://localhost:3876
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en

src/config/cors.php

@@ -4,13 +4,18 @@
     'paths' => ['api/*', 'sanctum/csrf-cookie'],
     'allowed_methods' => ['*'],
     'allowed_origins' => [
-        'http://localhost:3876',
-        'http://127.0.0.1:5173',
+        env('FRONTEND_URL', 'http://localhost:3876'),
         'https://zigzagdev.github.io',
     ],
     'allowed_origins_patterns' => [],
     'allowed_headers' => ['*'],
     'exposed_headers' => [],
     'max_age' => 0,
-    'supports_credentials' => false,
+
+    // Sanctum's cookie-based SPA auth sends requests with `credentials: 'include'`.
+    // If this is false, the browser will discard the session cookie on cross-origin
+    // responses even though the cookie itself was issued successfully, so the
+    // frontend appears logged in but authenticated requests (e.g. fetching the
+    // current user) fail silently.
+    'supports_credentials' => true,
 ];

src/config/sanctum.php

@@ -5,6 +5,15 @@
 use Laravel\Sanctum\Http\Middleware\AuthenticateSession;
 use Laravel\Sanctum\Sanctum;
 
+$frontendUrl  = env('FRONTEND_URL', 'http://localhost:3876');
+$frontendHost = parse_url($frontendUrl, PHP_URL_HOST);
+$frontendPort = parse_url($frontendUrl, PHP_URL_PORT);
+
+// Sanctum only treats requests from a listed domain/host as cookie-based SPA
+// requests; anything else falls back to requiring a bearer token. The frontend
+// (FRONTEND_URL) must be listed here or its session cookie is never checked.
+$frontendStatefulDomain = $frontendPort ? "{$frontendHost}:{$frontendPort}" : $frontendHost;
+
 return [
 
     /*
@@ -19,8 +28,9 @@
     */
 
     'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', sprintf(
-        '%s%s',
+        '%s,%s%s',
         'localhost,localhost:3000,127.0.0.1,127.0.0.1:8000,::1',
+        $frontendStatefulDomain,
         Sanctum::currentApplicationUrlWithPort(),
         // Sanctum::currentRequestHost(),
     ))),