Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

truetaurus's avatar

Anyone used Laravel as the backend api with Next.js as the frontend? Cookies not passed automatically.

The issue I have is locally cookies are passed in the headers automatically. I use Axios with withCredentials set to true. But then on production, the cookies are not passed. The only different I can think of is on production I use Nginx for the routing to my api. Here is my server block:

erver {
    listen 80;

        server_name mywesbite.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

    server {
            listen 80;
            server_name api.mywesbite.com;

            add_header Access-Control-Allow-Headers *;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE' always;

            root /root/mywesbite/api/public;
            index index.php index.html index.htm;

            location / {
                    add_header Access-Control-Allow-Headers *;
                    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE' always;
                    try_files $uri $uri/ /index.php?$query_string;
            }

            location ~ \.php$ {
                    try_files $uri /index.php = 404;
                    fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
                    fastcgi_index index.php;
                    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                    include fastcgi_params;
            }
    }

My axios request is configured like this:

const client = axios.create({withCredentials: true});

Has anyone experienced this issue? As I assume this is a problem with my nginx setup, i have not provided any other configs. If you require more I can provide.

0 likes
2 replies
truetaurus's avatar

So I have decided to just set a random header (Authorization) and then pass that automatically with every request and that seems to work. Not sure if its "correct" though.

techjeed's avatar

set SESSION_DOMAIN= in .env and if you are using diffrent domain in front and back end then set SameSite = 'none' in config/session

1 like

Please or to participate in this conversation.