Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

xuma's avatar
Level 9

Laravel-echo-server with sanctum

First of all i want to point that i think this issue is related to https://github.com/tlaverdure/laravel-echo-server/issues/500 this one but i cant figure out any way to solve this problem.

My Vue SPA app works fine with sanctum. I am using SPA authentication method. (https://laravel.com/docs/7.x/sanctum#spa-authentication)

Now i'm trying to implement websockets and laravel-echo-server is seems better than any other for me.

I took below steps to configure websockets. Public channels works fine but i'm stuck at private channel authentication.

App url: https://app.project.test
Api url: https://app.project.test/api/v1
Web socket server: http://localhost:6001
  1. Used below configuration for laravel-echo-server. My api prefixed with v1
{
	"authHost": "https://app.project.test",
	"authEndpoint": "/api/v1/broadcasting/auth",
	"database": "redis",
	"databaseConfig": {
		"redis": {
			"port": "6379",
			"host": "127.0.0.1",
			"db": "0",
			"password": "myredispassword"
		},
		"sqlite": {
			"databasePath": "/database/laravel-echo-server.sqlite"
		}
	},
	"devMode": true,
	"host": null,
	"port": "6001",
	"protocol": "http",
	"socketio": {},
	"secureOptions": 67108864,
	"sslCertPath": "",
	"sslKeyPath": "",
	"sslCertChainPath": "",
	"sslPassphrase": "",
	"subscribers": {
		"http": true,
		"redis": true
	},
	"apiOriginAllow": {
		"allowCors": true,
		"allowOrigin": "https://app.project.test",
		"allowMethods": "GET, POST",
		"allowHeaders": "Origin, Content-Type, X-Auth-Token, X-Requested-With, Accept, Authorization, X-CSRF-TOKEN, X-Socket-Id"
	}
}
  1. Enabled BroadcastServiceProvider in config/app and placed below code to routes/api.php
Broadcast::routes(['middleware' => ['auth:sanctum']]);
  1. Enabled Echo for my vue app. Socket io library already included
const  echoInstance  = new Echo({
  broadcaster: "socket.io",
  host: 'http://localhost:6001',
  //csrfToken: token,
  auth: {
    headers: {
      'Referer': 'localhost',
      // 'Accept': 'application/json',
      // 'Content-Type': 'application/json',
      // "X-CSRF-Token": token
    }
  },
  authorizer: (channel, options) => {
      return {
          authorize: (socketId, callback) => {
              axios.post('/api/v1/broadcasting/auth', {
                  socket_id: socketId,
                  channel_name: channel.name
              })
              .then(response => {
                  callback(false, response.data)
              })
              .catch(error => {
                  callback(true, error)
              })
          }
      }
  },
})
Vue.prototype.$echo = echoInstance    
  1. I placed below code to my routes/channels.php
Broadcast::channel('App.User.{id}', function ($user, $id) {
    return (int) $user->id === (int) $id;
});

Requests not even reach 4. step. Sanctum gives Unauthenticated. error.

Here is my .env sanctum configuration which is working perfectly fine with Vue SPA.

SANCTUM_STATEFUL_DOMAINS=project.test,127.0.0.1,localhost,localhost:6001,app.project.test
SESSION_DOMAIN=.project.test
API_URL=https://app.project.test/api/v1/
0 likes
6 replies
Dfns's avatar

hi, did you found the solution to this? I'm having the same issue

Tetereou's avatar

Are you using the default login route,or you created yours? If the default route,you should let the default broacast channels routes as it was

dev@nasiriyima.com's avatar

Although this is a very old post. However, I guess the headers for the request isn't properly configured. You will need to add headers for api authentication to the axios header configuration eg.

const url = "/api/broadcastin/auth"
const data = {
      socket_id : socketId,
      channel_name: channel.name   
}
const config = {
    headers: {
           "content-type": "application/json",
           "Authorization":  "Bearer "+ authUser().token
   }
}
axios(url, data, config)

Please or to participate in this conversation.