Laravel 9 Sanctum使用Axios GET时未设置CSRF Cookie问题求助

我正在使用Laravel（v9.52.4）+ Sanctum实现简单认证功能，前端通过Axios发起数据请求。前后端均运行在http://127.0.0.1:8000，API端点格式为http://127.0.0.1:8000/api/v1/{endpoint}。

登录逻辑本身正常：传入正确凭证时，后端会生成并存储Token，返回成功响应；凭证错误时也会返回对应提示，但后端未发送/设置CSRF Cookie，导致登录后访问管理子页面时被重定向至登录页，无法完成授权访问。

此前使用XAMPP本地托管项目时，整个认证流程完全正常；将项目迁移到非htdocs目录、改用php artisan serve启动后，仅CSRF Cookie设置功能出现异常。以下是相关配置代码：

.env 配置（ROOT_URL变量用于生成前端HTML和JS的URL） #

APP_URL=http://127.0.0.1:8000
...
SESSION_DOMAIN = "127.0.0.1:8000"
SANCTUM_STATEFUL_DOMAINS = "127.0.0.1:8000"
ROOT_URL="http://127.0.0.1:8000"

AuthController（/login路由对应此控制器方法） #

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Http\Response;

class AuthController extends Controller
{
    public function login(Request $request){
        $credentials = [
            'email' => $request->email, 
            'password' => $request->password
        ];

        if(Auth::attempt($credentials)){
            $authUser = Auth::user();
            $success['token'] = $authUser->createToken('APIToken')->plainTextToken;
            $success['name'] = $authUser->name;
            return response()->json(['user' => $success], 200);
        }
        else {
            return response()->json(['error' => "Unauthenticated"], 404);
        }
    }

    public function logout(Request $request, $isAPI = true){
        $request->session()->invalidate();
        $request->session()->regenerateToken();

        auth()->user()->tokens()->delete();
        if($isAPI){
            return response()->json(['msg' => "user logged out"], 200);
        }
        return view('admin.login');
    }
}

cors.php 配置 #

'paths' => ['api/*', 'sanctum/csrf-cookie'],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,

Kernel.php 配置（已导入并添加中间件） #

...        
'api' => [
            \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
            'throttle:api',
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],
...

前端Axios处理代码 #

const API_ROOT = `${ROOT_URL}/api/v1`
axios.defaults.withCredentials = true

async function loginUser(credentials){ //这些凭证来自HTML表单输入
    const CSRF = `${ROOT_URL}/sanctum/csrf-cookie`
    const LOGIN_URL = `${API_ROOT}/login`

    toggleLoader()
    await axios.get(CSRF)
    await axios.post(LOGIN_URL, credentials)
        .then((res) => handleResponse(res.data))
        .catch((err) => console.log(err))
        .finally(() => toggleLoader())
}

function handleResponse(response){
    if(response.user){
        console.log(`Logged in as ${response.user.name}`)
        window.location.replace(`${ROOT_URL}/admin`)
        return
    }
    console.log('failed to log in')
}

希望有遇到过此问题的开发者能提供帮助，感谢所有建议！祝您愉快！

内容的提问来源于stack exchange，提问作者torokakos98