Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

jeh5256's avatar
Level 26

Laravel Sanctum On Staging/Production Site With Similar Domain

I am running into CSRF mismatch issues on a staging and production site that I am using Laravel Sanctum on that is using session cookies.

I have a production site that has an admin and public facing site with domains of https://admin.domain.com and https://domain.com. In the .env file, the SESSION_DOMAIN is set to .domain.com.

I also have the exact same setup on a staging domain of https://admin.staging.domain.com and https://staging.domain.com. In the .env file, the SESSION_DOMAIN is set to .staging.domain.com.

If a user has logged into both the staging site and the production site, then they will run into 419 CSRF Mismatch issues when making requests to the admin site from the public site. When I look at the network tab in the browser I can see session cookies for both the .staging.domain.com and the .domain.com sites as well as an XRSF-TOKEN cookie for each site. I believe the wrong XSRF-TOKEN is being sent with the API request and that is causing the 419 CSRF Mismatch issue. Any one have any recommendations to prevent the issue from happening without changing domains?

0 likes
0 replies

Please or to participate in this conversation.