Best way to implement an API for an SPA and mobile app

1. Yes, CSRF/CORS protection is necessary for your API to prevent unauthorized access and protect against cross-site scripting attacks.
2. You can implement CSRF/CORS protection in your stateless Laravel Sanctum API by adding the appropriate middleware to your routes. For example, you can use the VerifyCsrfToken middleware to protect against CSRF attacks and the Cors middleware to enable CORS.

// Example route with CSRF and CORS protection
Route::middleware(['cors', 'csrf'])->post('/example', function () {
    // Handle request
});

1. You can use a stateful API when implementing an API for both SPA and native mobile apps, but it may not be the best approach. A stateful API requires the client to maintain a session with the server, which can be difficult to manage in a distributed environment. A stateless API, on the other hand, is easier to scale and can be used by any client that can authenticate with a token.
2. There are security concerns with an infinite valid token, as it can be used by an attacker to gain unauthorized access to your API. To mitigate this risk, you can set an expiration time for your tokens using the withTTL method in Laravel Sanctum.

// Example token with a 1-hour expiration time
$token = $user->createToken('token-name')->withTTL(60 * 60)->plainTextToken;

1. Laravel Passport is a good option if you need to implement OAuth 2 authentication for your API. OAuth 2 is a widely-used standard for authentication and authorization, and Laravel Passport provides a simple way to implement it in your Laravel application. However, it may be overkill if you only need to authenticate users for your SPA and mobile apps. Laravel Sanctum provides a simpler way to authenticate users with tokens, which may be sufficient for your needs.