Laravel 10：如何禁用API的Session及CSRF Cookie？

我需要禁用Laravel应用的所有Cookie，目前Web路由的Cookie已成功禁用，但浏览器访问API时仍会收到Laravel Session和CSRF Cookie。奇怪的是，只有生产服务器会返回Set-Cookie响应头，本地环境不会，且两台环境的.env文件除数据库连接外配置完全一致。

相关代码文件 #

app/Http/Kernel.php #

class Kernel extends HttpKernel
{
    /**
     * The application's global HTTP middleware stack.
     *
     * These middleware are run during every request to your application.
     *
     * @var array<int, class-string|string>
     */
    protected $middleware = [
        // \App\Http\Middleware\TrustHosts::class,
        \App\Http\Middleware\TrustProxies::class,
        \Illuminate\Http\Middleware\HandleCors::class,
        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        \App\Http\Middleware\TrimStrings::class,
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
    ];

    /**
     * The application's route middleware groups.
     *
     * @var array<string, array<int, class-string|string>>
     */
    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            //\Illuminate\Session\Middleware\StartSession::class,
            // \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            // \App\Http\Middleware\VerifyCsrfToken::class,
            // \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],

        'api' => [
            \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
            \Illuminate\Routing\Middleware\ThrottleRequests::class.':api',
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],
    ];

    /**
     * The application's middleware aliases.
     *
     * Aliases may be used instead of class names to conveniently assign middleware to routes and groups.
     *
     * @var array<string, class-string|string>
     */
    protected $middlewareAliases = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'auth.session' => \Illuminate\Session\Middleware\AuthenticateSession::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
        'signed' => \App\Http\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
    ];
}

routes/api.php #

Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return ['username' => $request->user()->name];
});

Route::post('login', function (Request $request) {
    Log::debug('test');
    $post = $request->all();
    if (Auth::attempt(['name' => $post['username'], 'password' => $post['password']])) {
        return ['token' => $request->user()->createToken('api')->plainTextToken];
    }
    sleep(1);
    return response(["message" => "invalid credentials"], 401);
});

Route::middleware('auth:sanctum')->post('logout', function (Request $request) {
    $request->user()->currentAccessToken()->delete();
    return [
        'message' => 'logout completed'
    ];
});

Route::middleware('auth:sanctum')->patch('patch-index/texts/{category}', [TextController::class, 'patchIndexes']);
Route::middleware('auth:sanctum')->patch('patch-index/offers/{category}', [OfferController::class, 'patchIndexes']);

Route::middleware('auth:sanctum')->apiResource('texts', TextController::class);

Route::middleware('auth:sanctum')->apiResource('offers', OfferController::class);

Route::middleware('auth:sanctum')->get('categories/{category}', [CategoryController::class, 'show']);

已尝试的无效解决方案 #

• 在Kernel.php中禁用相关中间件
• 将SESSION_DRIVER改为array
• 在VerifyCsrfToken.php中排除所有路由

问题已解决
问题根源是\Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful中间件，禁用该中间件后问题解决。

内容的提问来源于stack exchange，提问作者Thorkell