title: How to pass a CSRF token safely to a separate VueJS frontend?
body: <p>Laravel(backend) and VueJS(frontend created with Vue CLI) are separated, hence have different domains and repositories. I am wondering what is the best way to pass a CSRF token from Laravel to VueJS <strong>safely</strong>.</p>
  
  <p>I've found some old questions here and on Laracasts but they are either irrelevant, outdated or have no answer. Here are a few:</p>
  
  <p><a href="https://stackoverflow.com/questions/50325287/pass-csrf-token-from-laravel-to-vue">Pass csrf token from Laravel to Vue</a></p>
  
  <p><a href="https://stackoverflow.com/questions/33189948/creating-a-sign-up-token-for-laravel-app-from-separate-frontend-app">Creating a sign up token for Laravel app from separate frontend app</a></p>
  
  <p><a href="https://laracasts.com/discuss/channels/general-discussion/csrf-in-separate-angular-app" rel="nofollow noreferrer">(Laracasts forum) CSRF in separate angular app</a></p>
  
  <p>I am aware that Laravel ships with <code>$except</code> array in VerifyCSRFToken middleware. Adding frontend's URL to this list will create a security flaw, am I correct?</p>