Sanctum SPA CSRF Token Mismatch via Postman

Hi,

As the title implies, I'm having an issue where I'm sending a request via Postman to my API, however I'm met with a 419 error. My Laravel app is on the domain "admin-api.foobar.local". Along side this, I am also developing a frontend on the subdomain "admin.foobar.local". I'd like to highlight that I've also created a new vhost under just the top level domain "foobar.local", copied all the code across and I didn't encounter this issue. This leads me to believe that the CSRF, even when on the same top level domain cannot be issued by a subdomain. Unfortunately this needs to be on its own subdomain and moving this to the top level domain is a non-negotiable.

I personally don't see anything that should be causing an issue as I've set this up time and time again, however it has always been from the top level domain and never from a subdomain which has led me to believe CSRF cannot be set from a subdomain.

Please let me know what's going on!

UPDATE:

For some reason when I comment out 'SESSION_DOMAIN=...' from my .env file, everything starts to work? This doesn't seem right to me, any insight would be welcome!

UPDATE 2:

When I uncomment out 'SESSION_DOMAIN=...', authentication work on my frontend but not in Postman, it also appears to be ignoring the Referer header when I submit on my frontend as I've tried changing the domains listed in my 'SANCTUM_STATEFUL_DOMAINS' env variable and it still allows me to submit the auth and authenticates me?

My config/settings are as follows:

.env

APP_URL=http://admin-api.foobar.local
SESSION_DOMAIN=".foobar.local"
SANCTUM_STATEFUL_DOMAINS="admin.foobar.local,admin.foobar.local:3000"

config/cors.php

return [
    'paths' => ['api/*', 'sanctum/csrf-cookie', 'login', 'logout', 'register'],
    'allowed_methods' => ['*'],
    'allowed_origins' => ['*'],
    'allowed_origins_patterns' => [],
    'allowed_headers' => ['*'],
    'exposed_headers' => [],
    'max_age' => 0,
    'supports_credentials' => true,
]

app/Http/Kernel.php

protected $middlewareGroups = [
    'api' => [
        \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
        'throttle:api',
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ]
];

routes/web.php

Route::post('/login', [AuthenticatedSessionController::class, 'store'])
    ->middleware(array_filter([
        'guest:'.config('fortify.guard'),
        $limiter ? 'throttle:'.$limiter : null,
    ]));

Postman request: POST http://admin-api.foobar.local/login

Prerequest Script

pm.sendRequest({
    url: "http://admin-api.foobar.local/sanctum/csrf-cookie",
    method: 'GET',
}, function (err, response) {
    const cookieJar = pm.cookies.jar();    
    cookieJar.get('.foobar.local', 'XSRF-TOKEN', (error, cookie) => {
        if (error) { 
            console.log(error);
        }
        if (cookie) {
            pm.collectionVariables.set('xsrf-cookie', cookie);
            console.log(cookie);
        }
    })
});

Body

{
    "email": "[email protected]",
    "password": "Foobar123!"
}

Headers:

Referer: http://admin.foobar.local
Accept: application/json
X-XSRF-TOKEN: {{xsrf-cookie}}

Thanks for your help!