Laravel sanctum unauthenticated

Question

I am using Laravel sanctum in my project with angular as frontend. Getting unauthenticated from the second api request. Please let me know where am I going wrong

Frontend-> 127.0.0.1:4200

Backend-> localhost:8888

.env config

SESSION_DOMAIN=localhost SANCTUM_STATEFUL_DOMAINS=127.0.0.1

Added middleware auth:sanctum to the routes group in api.php

Ref: https://prnt.sc/rm9ejy

Stanley Aloh · Answer 1 · 2022-01-13T14:23:31.603

For anyone having an Unauthenticated error, please ensure you follow these steps.

Send a GET request to /sanctum/csrf-cookie
Send a post request to web route /login to get authenticated

After this step, you will be successfully authenticated by auth:sanctum middleware in the API route.

Other things to be aware of:

Ensure your SESSION_DOMAIN is set to localhost
SANCTUM_STATEFUL_DOMAIN is set to your sub domain/SPA with the port e.g localhost:8000

For the original question please ensure you maintain same domain. I mean use localhost for both. And set SANCTUM_STATEFUL_DOMAIN = localhost:4200

Edited

Also set SESSION_DRIVER

I think the request to `/sanctum/csrf-cookie` needs to be a `GET` request. — Chris J, May 22 '21 at 11:05

score 8 · Answer 2 · answered May 25 '21 at 18:54

8

Add your domains, for example my API is running on localhost:8000 my client is running on localhost:3000 so my env setting looks like below

SANCTUM_STATEFUL_DOMAINS=localhost:8000,localhost:3000

also, add your session domain

SESSION_DOMAIN=localhost

answered May 25 '21 at 18:54

HadiNiazi

1,031
1
7
17

I used custom domain name for calling the backend and frontend like (backend) `api.devtest.test` (frontend) `devtest.test` What should be written on `SESSION_DOMAIN` ? – Shulz Jul 21 '21 at 02:44

jrran90 · Answer 3 · 2021-11-02T09:35:51.457

6

Have you checked your Kernel.php? app/Http/Kernel.php

Make sure you uncomment \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class, coz by default it is being commented

'api' => [
    \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
    'throttle:api',
    \Illuminate\Routing\Middleware\SubstituteBindings::class,
],

edited Nov 02 '21 at 09:35

answered Nov 01 '21 at 16:20

jrran90

587
13
16

3

You nailed it! What you are suggesting also is into the docs, check here https://laravel.com/docs/8.x/sanctum#sanctum-middleware – Fernando Torres Nov 01 '21 at 19:45

score 4 · Answer 4 · answered Mar 31 '20 at 19:24

4

From the screenshot you shared I see your domain is localhost and not 127.0.01, just do:

SANCTUM_STATEFUL_DOMAINS=localhost

answered Mar 31 '20 at 19:24

Luis Montoya

2,847
1
15
24

score 3 · Answer 5 · answered Jun 02 '20 at 19:38

3

For anyone using Laravel Homestead, use your actual domain.

SANCTUM_STATEFUL_DOMAINS=homestead.test

answered Jun 02 '20 at 19:38

Daniel

118
6

1

This worked for me when using a dummy domain "app.test" under my computer's `/etc/hosts` file – OzzyTheGiant Jun 10 '20 at 17:46

gitmiro · Answer 6 · 2020-07-01T18:09:12.983

3

Which version are you running? Since V2.4.0 you need to specify the port:

SANCTUM_STATEFUL_DOMAINS=localhost:4200

See this issue for more info.

edited Jul 01 '20 at 18:09

answered Jul 01 '20 at 08:29

gitmiro

81
4

score 1 · Answer 7 · edited Nov 18 '20 at 10:16

1

Two days of pain and despair to arrive at this conclusion: the Bearer token was not attached to the request, and that was because of my .htaccess configuration.

If you, like me, are not able to authenticate via API token, try to add this line on your .htaccess file in the public directory in your Laravel project:

RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

Right after RewriteEngine On directive.

CREDITS: Laravel not detecting auth token sent in the header and JWT package

edited Nov 18 '20 at 10:16

Dharman

26,923
21
73
125

answered Nov 18 '20 at 10:11

Marco Cazzaro

532
5
13

Sanctum doesn’t use token for Stateful auth. It uses cookies. – LDUBBS Jun 10 '21 at 12:36
1

pain and despair, I know how you feel ! – Sharkfin Dec 15 '21 at 19:46
1

Thanks man, The above solution works!! I've wasted a lot of time figuring out on my own. – Albert George Feb 07 '22 at 12:28

score 0 · Answer 8 · answered Aug 18 '21 at 16:14

0

The sanctum stateful domains require the port number as well.

e.g. SANCTUM_STATEFUL_DOMAINS=127.0.0.1:4200

Although in your case your screenshot shows it should be SANCTUM_STATEFUL_DOMAINS=127.0.0.1:4201

answered Aug 18 '21 at 16:14

Peter Fox

1,707
2
18
33

score 0 · Answer 9 · edited Nov 01 '21 at 14:48

0

I had the same solution as Marco, adding the rewrite rule to my htaccess in public fixed it.

RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

FYI I am hosting this on Auzre Web App Service (linux), if anyone else is doing that.

edited Nov 01 '21 at 14:48

Nimantha

5,793
5
23
56

answered Nov 01 '21 at 12:43

Robert Lane

1
1
1

Laravel sanctum unauthenticated

9 Answers9

Linked