Unable to retrieve XSRF-TOKEN cookie from Laravel Sanctum API using Chrome extension

@vincent15000 here's the code which i'm using for fetch xcsrf token from laravel sanctum async function getCsrfToken(apiUrl) { const apiUrl = '127.0.0.1:8000'; return fetch(apiUrl + '/api/sanctum/csrf-cookie', { credentials: 'include', mode: 'cors', headers: { 'X-Requested-With': 'XMLHttpRequest' }, withCredentials: true }).then((response) => { return response.csrf_token.get('X-CSRF-TOKEN'); }); }

laravel sanctum config's in .env file

SESSION_DOMAIN="127.0.0.1" SANCTUM_STATEFUL_DOMAINS="127.0.0.1:8000,chrome-extension://ohfnmoknmmnkfocgigbockoiidnmclnj"

@SallahUddin007 Why do you need to retrieve the CSRF token ? Is it for authentication ? In that case Laravel do that automatically.

@vincent15000 you're right, but issue is i'm working on chrome-extension development and using laravel api for login authentication,

By default when we send a call on /sanctum/csrf-cookie it returns cookie in the header and auto-save to the browser and the laravel/sanctum required top-level domain to retrieve and store cookie in API call.

but in my case, api call is initiating from chrome extension and it don't have any domain so the laravel sanctum is not responding proper headers to save cookine after fetch call complete

@SallahUddin007 What's this Chrome extension ?

@vincent15000 it's like for create todo's and reminders but it's connected to laravel app which provide various of functionality for teams.

Chrome extension allows user to use functionality through api after authentication.

@Pippo hi there, Clarification I'm using default fetch() to get xcsrf-token from laravel sanctum.

@SallahUddin007 The token is sent in a cookie, you have to extract it more or less like this:

    const value = `; ${document.cookie}`;
	const parts = value.split('; XSRF-TOKEN=');
	let token = false;

	if (parts.length === 2) 
				token = decodeURIComponent(parts.pop().split(';').shift());

	if (!token) 
				throw new Error ('Token not found');

otherwise with axios the dirty work is already done by it

@Pippo Yes you're right token is sent in a cookie, but how can i extract this because it's in the fetch call response header, and api endpoint is using laravel sanctum with laravel fortify.

By default when we send a call on /sanctum/csrf-cookie it returns cookie in the header and auto-save to the browser, the laravel/sanctum required top-level domain to retrieve and store cookie in API call but in my case, I'm using it in chrome extension development it doesn't have any domain to add in top-level domain for laravel/sanctum.

I hope it clarifies what I meant to say...

@SallahUddin007 if you can force/set the Referer header in the message sent by the chrrome extension

@Pippo Already tried to set headers in fetch call but didn't work, In config/session.php session.same_site: lax which support cors request but i changed that to none and null which means cors issue have to resolved but it doesn't work

Somehow laravel sanctum is not allowing host to retrieve header cookies data.