We have an app at anotherdomain.com that is the main entry for all https requests. It then loads the site requested based on data it got. can be a site under app domain called app-domain.com in this story OR can be sub.domain.com as happens here. We currently get
Cookie “XSRF-TOKEN” has been rejected for invalid domain. sub.domain.com
for fonts that are loaded from public sites from /home/user/site.com/shared/public/published/site.com/fonts or https://*.site.com/fonts/* using api data from app-domain.com
Verify Csrf Token Exception Failed
I added https://*.site.com/fonts/* to
<?php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
class VerifyCsrfToken extends Middleware
{
/**
* Indicates whether the XSRF-TOKEN cookie should be set on the response.
*
* @var bool
*/
protected $addHttpCookie = true;
/**
* The URIs that should be excluded from CSRF verification.
*
* @var array
*/
protected $except = [
'api/form-service',
'webhook/mollie',
https://*.site.com/fonts/*,
];
}
of our laravel app at app-domain.com and main entry point on our server as a URI to except at app/Http/Middleware/VerifyCsrfToken.php , but this does not seem to work, or I missed something adding it.
Fonts Failing to load still
The fonts are local and downloaded on publication, but now these fail:
Some cookies are misusing the recommended “SameSite“ attribute 10
Cookie “XSRF-TOKEN” has been rejected for invalid domain. sub.domain.com
Cookie “site_production_session” has been rejected for invalid domain. sub.domain.com
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. site.domain.com
Cookie “domain_production_session” has been rejected for invalid domain. JTUQjIg1_i6t8kCHKm45_QpRyS7m.woff2
downloadable font: download failed (font-family: "Montserrat" style:normal weight:100 stretch:100 src index:2): status=2147746065 source: https://sub.domain.com/published/sub.domain.com/fonts/montserrat/v15/JTUQjIg1_i6t8kCHKm45_QpRyS7m.woff2
How can I except this fonts loading and display properly and get things to work well here? No specific route used for the loading of fonts so I do think I need to add an exception in app to allow published site on other domain to allow the loading of the CSRF token , other cookies and fonts. But how?
