You should not need this " axiosClient.get('/sanctum/csrf-cookie').then(response => { " What does your app.blade.php look like?

You don't have the CSRF loaded in the head do you?

Axios automatically grabs the CSRF token https://inertiajs.com/docs/v2/security/csrf-protection#csrf-protection:~:text=Laravel%20automatically%20includes%20the%20proper%20CSRF%20token%20when%20making%20requests%20via%20Inertia%20or%20Axios.%20However%2C%20if%20you%E2%80%99re%20using%20Laravel%2C%20be%20sure%20to%20omit%20the%20csrf%2Dtoken%20meta%20tag%20from%20your%20project%2C%20as%20this%20will%20prevent%20the%20CSRF%20token%20from%20refreshing%20properly.

@janum Thanks for all that insight!

@jussimannisto It is all become super clear the last few days for me where I have gone wrong. I just wish I knew all this info months ago but never again will I struggle.

Appreciate your responses!

Speaking of LLMs being wrong:

5. For Inertia, always make the first request visit /sanctum/csrf-cookie A lot of devs forget this step. Once the cookie is set, the CSRF header is handled automatically. No need to manually fetch the token at all.

This is pointless with Inertia. The initial Inertia page response already includes the cookie. You'd only need this step if you had a pure SPA with Laravel as a backend API.

I have been noticing the same thing

@jussimannisto

Any chance this in the app.blade.php could be the culprit?

" " I found this in the Inertia docs "Laravel automatically includes the proper CSRF token when making requests via Inertia or Axios. However, if you're using Laravel, be sure to omit the csrf-token meta tag from your project, as this will prevent the CSRF token from refreshing properly."

Looks like it snuck into our app 8 months ago when AI told me it would fix some ongoing 419 errors.

Look at other files in this commit, I was using Fetch for the requests.

It's all making sense in hindsight but also really frustrating the dev working on this is not able to quickly diagnose and troubleshoot this.

I am digging around for some 419 errors we are still having @gabotronix

According to the Inertia docs, you actually don't want the CSRF token baked into the

It will be handled with cookies. This does not allow a proper refresh from what I am learning.

https://inertiajs.com/csrf-protection?utm_source=chatgpt.com#:~:text=Laravel%20automatically%20includes%20the%20proper%20CSRF%20token%20when%20making%20requests%20via%20Inertia%20or%20Axios.%20However%2C%20if%20you%27re%20using%20Laravel%2C%20be%20sure%20to%20omit%20the%20csrf%2Dtoken%20meta%20tag%20from%20your%20project%2C%20as%20this%20will%20prevent%20the%20CSRF%20token%20from%20refreshing%20properly.

Have you found a fix after a year?

What is out there for building a custom ecom store on Laravel?

I am curious if there is anything similar to MedusaJS but on Laravel/PHP.

Has anyone built ecom on Laravel/PHP before?

Thanks for the reply!

I do! But ensuring it is working everywhere has been tough. I get why it exists.

Is CSRF token in the global Inertia props by default?

So should I just use Axios for all backend requests?

can anyone add some input as how to best handle CSRF throughout a Laravel/React app?

It was immensely painful to figure out with partial and occasional failures. Different ENVs failed at different rates.

From our app to Stripe and back was a common 419 error. Our checkout session is excluded from CSRF to make it seamless.

I have since mitigated almost entirely with a React Util to refresh tokens and grab it before hitting controllers and such.

I tried so many different ways and they all had different rates of success.

We are now in production with a small user base and I still see 419 errors in NightWatch for one specific part of the app. Normally after one failure they get through.

But I can't seem to find any info online. It's all 5-7 years old.

Keep in mind I am not traditionally trained. I am self taught and rely on AI for writing the code but I can architect and build just about thing and I am quite good at reading and understanding code and catching the flaws of AI.

So I have my gaps.

But any info into the modern Laravel 12 with React handling CSRF PERFECTLY, with no failures in the app, would be great.

I feel we are smooth sailing once we get this one area worked out.

A dev helping me has a vast training but is just as stuck as I am am when it comes to CSRF.

Anything that may be remotely helpful, please chime in!