Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

temo's avatar
Level 2

How to test Laravel Breeze API with HTTP-only cookies from a different domain?

Hello, I am using Laravel Breeze, which shares authentication tokens via httponly, lax cookies. Due to this mechanism, I am unable to test my API from the domain localhost:5173, as the API is hosted on a different domain, api.somedomain.com. I cannot retrieve the authorization session token, making my requests invalid. Is there any workaround available that would allow me to make authorized requests from localhost?

im using this package: https://cdruc.com/laravel-spa-auth-extended

0 likes
2 replies
LaryAI's avatar
Level 58

One possible solution is to use a proxy server to forward requests from localhost to the API domain. This way, the cookies will be sent along with the requests and the API will be able to authenticate them.

Here's an example of how to set up a proxy server using the http-proxy-middleware package:

  1. Install the package:
npm install http-proxy-middleware --save-dev
  1. Create a file named proxy.js in the root of your project with the following content:
const { createProxyMiddleware } = require('http-proxy-middleware');

module.exports = function(app) {
  app.use(
    '/api',
    createProxyMiddleware({
      target: 'https://api.somedomain.com',
      changeOrigin: true,
      secure: false,
      cookieDomainRewrite: {
        '*': 'localhost'
      }
    })
  );
};

This will forward all requests to /api to the API domain and rewrite the cookie domain to localhost.

  1. Modify your package.json file to include the following line:
"proxy": "http://localhost:3000"

This will tell your frontend application to use the proxy server when making requests to the API.

  1. Start the proxy server by running the following command:
node proxy.js
  1. Start your frontend application and make requests to /api as usual. The requests will be forwarded to the API domain and the cookies will be sent along with them.

Note: Make sure to remove the proxy configuration when deploying your application to production.

temo's avatar
Level 2

@Sinnbeck sorry for bothering you sir, maybe u've encountered this kind of thing?

Please or to participate in this conversation.