Enable login on a second domain for a single application, looking for some feedback

Hello,

Thank you for your time. I am a novice Laravel developer seeking advice on sharing login information on a secondary FQDN for a single Laravel application.

I have devised the following solution (excluding Laravel Sanctum, which I am not yet familiar with). I would like to ascertain if this practice is common and adheres to security measures such as CSRF.

Please note that all domains stored within the application can be designated as secure, as they are all hosted on the same server.

Any tips or suggestions are welcome.

Main domain NGINX

# http to https redirect
server {
    listen 80;
    listen [::]:80;
    server_name www.domain1.com;
    return 301 https://www.domain1.com$request_uri;
}

# the server
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.www.domain1.com;
    ssl_certificate /etc/letsencrypt/live/www.domain1.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.domain1.com/privkey.pem;

    client_max_body_size 25M;

    root   /var/www/www.domain1.com/public;
    index  index.php index.html index.htm;

    location / {   
        try_files $uri $uri/ /index.php$is_args$args;
    }   

    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

Second domain NGINX

# http to https redirect
server {
    listen 80;
    listen [::]:80;
    server_name www.domain2.com;
    return 301 https://www.domain2.com$request_uri;
}

# the server
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.www.domain1.com;
    ssl_certificate /etc/letsencrypt/live/www.domain2.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.domain2.com/privkey.pem;

    client_max_body_size 25M;

    root   /var/www/www.domain1.com/public;
    index  index.php index.html index.htm;

    location / {  
        try_files $uri $uri/ /index.php$is_args$args;
    }   

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

AppServiceProvider

<?php

namespace App\Providers;

use App\Services\OriginService;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\ServiceProvider;

/**
 * Class AppServiceProvider
 * @package App\Providers
 */
class AppServiceProvider extends ServiceProvider
{
    /**
     * Register any app services.
     */
    public function register(): void
    {
    }

    /**
     * Bootstrap any app services.
     */
    public function boot(): void
    {
         OriginService::validateOrigin(request());
    }
}

OriginService

<?php

namespace App\Services;

use App\Models\Origin;
use Illuminate\Http\Request;

/**
 * Class OriginService
 * @package App\Services
 */
class OriginService
{
    /**
     * @param Request $request
     * @return void
     */
    public static function validateOrigin(Request $request): void
    {
        $origins = Origin::where(['url' => $request->getHost()])->exists();

        // Origin doesn't exist
        if (!$origins) {
            return;
        }

        config(['session.domain' => $request->getHost()]);
    }
}

Web route

Route::get('/auth/login', [SessionController::class, 'create'])->name('login');
Route::post('/auth/login', [SessionController::class, 'store'])->middleware('throttle:20,1');
Route::post('/auth/logout', [SessionController::class, 'destroy']);

Blade login view

<h1 class="fs-2 my-2 text-center">{{ __('messages.login') }}</h1>
<form method="POST" action="/auth/login">
    @csrf
    <div class="bg-body-tertiary p-4 rounded-2 border border-gray-300">
        <x-language-selection-form></x-language-selection-form>
        <x-form-input class="mt-2" name="username" label="{{ __('messages.username') }}" value="{{ old('username') }}"
                      required></x-form-input>
        <x-form-error class="mt-2" name="username"></x-form-error>
        <x-form-input class="mt-2" name="password" type="password" label="{{ __('messages.password') }}"
                      required></x-form-input>
        <x-form-error class="mt-2" name="password"></x-form-error>
        <div class="form-check mt-2">
            <input class="form-check-input" type="checkbox" name="remember" id="remember" {{ old('remember') ? 'checked' : '' }}>
            <label class="form-check-label" for="remember">{{ __('messages.remember_me') }}</label>
        </div>
        {{-- Add the return url after the login if this is set --}}
        @if(request()->has('return_url'))
            <input type="hidden" name="return_url" value="{{ request()->get('return_url') }}">
        @endif
        <div class="text-end">
            <x-button class="mt-2" type="submit">{{ __('messages.login') }}</x-button>
            <x-link class="mt-2"
                    href="/auth/forgot-password?lang={{ request()->query('lang', 'en') }}">{{ __('messages.forgot_password') }}</x-link>
        </div>
    </div>
</form>