title: Laravel Sanctum with SPA: Best practice for setting the CSRF cookie
body: <p>Currently, my SPA is simple and has only a contact form. The form data is sent to the backend. I have installed Laravel Sanctum for that. </p>
  
  <pre><code>axios.get('/sanctum/csrf-cookie').then((response) =&gt; {
       axios.post('api/contact')
            .then((response) =&gt; {
                //doing stuff
            });
  });
  </code></pre>
  
  <p>This works perfectly fine. However, I was wondering. <strong>Where and which time in your SPA do you fire the initial request to get the CSRF cookie?</strong> (<code>axios.get('/sanctum/csrf-cookie')</code>)</p>
  
  <p>My first thoughts were:</p>
  
  <ul>
  <li>Every time the page is mounted/loaded</li>
  <li>Only when you receive a <code>419</code> and you attempt to refresh the token and retry the previous request</li>
  <li>You don't fire any API requests, only when the user tries to log in and only then you are requesting a cookie (in my case I don't have any user authentification)</li>
  <li>For each API request, you wrap it with <code>axios.get('/sanctum/csrf-cookie')</code> around</li>
  </ul>