Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Mike Swan's avatar

Looking for advice with sessions and cookies

Hi all,

I'm still fairly new to coding and Laravel so please bear with me. I am using Jetstream and part of the application is for a user to send a form to a non-user outside of the application. I am sending parameters through the url for the correct user model. I have middleware to make sure that other users cannot be accessed.

I guess my concern is that the user's session will still be apart of this process which could affect the csrf token for the form? My thought was to make this page completely isolated from the user session but I'm not sure what the best course of action would be. Everything works but I suspect that I'm missing something. I'm still getting my head wrapped around what an API is and if this falls into that category.

Would I use cookies for this or create a separate token using sanctum? It's probably pretty simple for a more experienced developer so I thought I'd reach out. I just want to make sure I'm on the right track.

The best way to describe to system is: User is logged in, User sends a form to someone to be filled out on a later date, When the form is submitted it only goes to the specific user, When the form is submitted it cannot be accessed again.

Any suggestions would be much appreciated.

Thanks!

0 likes
4 replies
jlrdw's avatar

If you haven't done so yet, I would really recommend that you take the laravel from scratch free series.

1 like
Mike Swan's avatar

@jlrdw Thanks for the reply....yea I've been through most of the tutorials but I use Jetstream so haven't really got into authentication and sessions. Just starting to dig into the deeper stuff now.

Snapey's avatar

use an encrypted url

when the external user opens the route via the link, it has nothing to do with authentication. CSRF will be for that session and nothing to do with the original sender.

All you need to do in the controller is load the user model mentioned in the URL, again, unauthenticated.

1 like

Please or to participate in this conversation.