had it a couple of weeks ago. Thought it had something to do with httpCookies Compare you Middleware with this one: https://github.com/laravel/laravel/blob/v5.7.0/app/Http/Middleware/VerifyCsrfToken.php
Upgrade to Laravel 5.7 problem consuming own API with Passport
Hi,
I just upgraded Laravel from 5.6 to 5.7 in my application and the only issue I discovered so far is the fact that any ajax request to my backend results in 401 Unauthorized. Everything worked fine on laravel 5.6.
I
- ran the migrations (didn't have any though)
php artisan migrate
- ran passport:install
php artisan passport:install
- driver option of the api authentication guard (in config/auth.php) is set to 'passport'
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
'api' => [
'driver' => 'passport',
'provider' => 'users',
],
],
- the RoutesServiceProvider implements 'api' and 'auth:api' middlewares for the ApiRoutes
Route::prefix('api/v1')
->middleware(['api', 'auth:api'])
->namespace($this->namespace)
->group(base_path('routes/api.php'));
- added CreateFreshApiToken::class to web middleware groups in app/Http/Kernel.php
protected $middlewareGroups = [
'web' => [
\App\Http\Middleware\EncryptCookies::class,
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
\Illuminate\Session\Middleware\StartSession::class,
// \Illuminate\Session\Middleware\AuthenticateSession::class,
\Illuminate\View\Middleware\ShareErrorsFromSession::class,
\App\Http\Middleware\VerifyCsrfToken::class,
\Illuminate\Routing\Middleware\SubstituteBindings::class,
\Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
],
...
];
Also, all Axios requests have the correct headers set in resources/assets/js/bootstrap.js:
window.axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';
let token = document.head.querySelector('meta[name="csrf-token"]');
if (token) {
window.axios.defaults.headers.common['X-CSRF-TOKEN'] = token.content;
} else {
console.error('CSRF token not found: https://laravel.com/docs/csrf#csrf-x-csrf-token');
}
I actualy ran all my migrations:fresh with seeders, cleared the cache but the darn thing still won't authenticate. Web links still work, I can authenticate in the application, I can even use Postman to make requests with a Barer token in the header and everything work. The only exception is consuming my own API from the front end.
Is there something I'm missing ?
Thanks in advance
Please or to participate in this conversation.