Laravel 8+Sanctum环境下API出现CSRF token mismatch问题求助

问题概述 #

使用Laravel 8结合Sanctum开发API时，为部分路由添加CSRF中间件后，始终触发「CSRF token mismatch」错误。即使先调用sanctum/csrf-cookie接口获取令牌，并通过X-CSRF-TOKEN请求头传递，问题仍未解决。

相关配置信息 #

.env 文件 #

SESSION_DRIVER=cookie
APP_DOMAIN_NAME=api.app.localhost
SESSION_LIFETIME=120
SESSION_SECURE_COOKIE=true
SESSION_DOMAIN=api.app.localhost
SANCTUM_STATEFUL_DOMAINS=https://api.app.localhost,localhost:3000,localhost:8000,127.0.0.1:3000,127.0.0.1:8000,localhost
SANCTUM_STATEFUL_DOMAINS=localhost:3000,localhost:8000,127.0.0.1:3000,127.0.0.1:8000,localhost

VerifyCsrfToken 中间件 #

class VerifyCsrfToken extends Middleware
{
    protected $addHttpCookie = true;
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'telescope/*',
        'sanctum/csrf-cookie'
    ];
}

session.php 配置 #

'driver' => env('SESSION_DRIVER', 'cookie'),

'encrypt' => true,

Kernel.php 中间件配置 #

protected $middlewareGroups = [
 'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        \Laravel\Jetstream\Http\Middleware\AuthenticateSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],

    'api' => [
        \App\Http\Middleware\ForceJsonResponse::class,
        \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
        'throttle:api',
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],
];

protected $routeMiddleware = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
        'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
        'csrf' => \App\Http\Middleware\VerifyCsrfToken::class,
    ];

api.php 路由配置 #

Route::post('auth/register', [AuthController::class, 'register'])->middleware('csrf');
Route::post('auth/login', [AuthController::class, 'login'])->middleware('csrf');
Route::get('user', [AuthController::class, 'user'])->middleware('csrf');

具体解决步骤 #

• 修复.env重复配置：删除重复的SANCTUM_STATEFUL_DOMAINS行，合并为一条正确配置。同时将SESSION_DOMAIN修改为.app.localhost（带前置点），确保子域名与主域名能共享Cookie：

  SANCTUM_STATEFUL_DOMAINS=api.app.localhost,localhost:3000,localhost:8000,127.0.0.1:3000,127.0.0.1:8000
  SESSION_DOMAIN=.app.localhost
  

  如果本地环境使用HTTP而非HTTPS，需将SESSION_SECURE_COOKIE设为false，否则Cookie无法被正常设置。

• 确保Session中间件优先执行：CSRF验证依赖Session，而当前API中间件组未包含Session相关中间件。可修改API中间件组，添加必要的Cookie和Session中间件：

  'api' => [
      \App\Http\Middleware\EncryptCookies::class,
      \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
      \Illuminate\Session\Middleware\StartSession::class,
      \App\Http\Middleware\ForceJsonResponse::class,
      \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
      'throttle:api',
      \Illuminate\Routing\Middleware\SubstituteBindings::class,
  ],
  

  或者给单个需要CSRF验证的路由单独添加中间件：

  Route::post('auth/register', [AuthController::class, 'register'])
      ->middleware(['AddQueuedCookiesToResponse', 'StartSession', 'csrf']);
  

• Postman请求设置检查：

  1. 开启Postman的「Enable cookies」选项，确保调用sanctum/csrf-cookie后，返回的Cookie被正确保存。
  2. 后续请求除了携带X-CSRF-TOKEN头部，还要确保请求自动携带laravel_session Cookie（Postman开启Cookie后会自动处理）。

• 清除系统缓存：执行以下命令清除配置、路由及应用缓存，确保修改后的配置生效：

  php artisan config:clear
  php artisan route:clear
  php artisan cache:clear
  

内容的提问来源于stack exchange，提问作者Desarrollador