From a263cc760132e567bfe2a69a730688c668ec3b96 Mon Sep 17 00:00:00 2001 From: admin Date: Thu, 30 Apr 2026 02:37:18 +0800 Subject: [PATCH] fix(web): include CSRF token on login + logout fetch Sanctum's statefulApi() runs same-origin API requests through the web middleware stack, which enforces CSRF. Send X-CSRF-TOKEN from the meta tag and credentials: same-origin so cookies travel with the request. Co-Authored-By: Claude Opus 4.7 (1M context) --- resources/views/auth/login.blade.php | 4 ++++ resources/views/dashboard.blade.php | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/resources/views/auth/login.blade.php b/resources/views/auth/login.blade.php index 797e750..cf5d4d2 100644 --- a/resources/views/auth/login.blade.php +++ b/resources/views/auth/login.blade.php @@ -164,11 +164,15 @@ }; try { + const csrf = document.querySelector('meta[name="csrf-token"]')?.content ?? ''; const res = await fetch('/api/v1/auth/login', { method: 'POST', + credentials: 'same-origin', headers: { 'Content-Type': 'application/json', 'Accept': 'application/json', + 'X-CSRF-TOKEN': csrf, + 'X-Requested-With': 'XMLHttpRequest', }, body: JSON.stringify(payload), }); diff --git a/resources/views/dashboard.blade.php b/resources/views/dashboard.blade.php index 5738f5c..ba78298 100644 --- a/resources/views/dashboard.blade.php +++ b/resources/views/dashboard.blade.php @@ -91,9 +91,16 @@ document.getElementById('logout-btn').addEventListener('click', async () => { try { + const csrf = document.querySelector('meta[name="csrf-token"]')?.content ?? ''; await fetch('/api/v1/auth/logout', { method: 'POST', - headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json' }, + credentials: 'same-origin', + headers: { + 'Authorization': `Bearer ${token}`, + 'Accept': 'application/json', + 'X-CSRF-TOKEN': csrf, + 'X-Requested-With': 'XMLHttpRequest', + }, }); } catch {} localStorage.removeItem('verde:token');