title: Laravel Stateless api jwt-auth and csrf token
body: <p>we are building website using <code>laravel</code> and <code>react</code>. also this two applications separated, <code>laravel</code> side only <code>api</code> and working on</p>
  
  <pre><code>api.example.com
  </code></pre>
  
  <p>and one <code>react</code> application working on 
  <code>example.com</code></p>
  
  <p>For authentication, we are using <code>JWT</code> and holding token secure httpOnly cookie. Our problem is also we want to use CSRF token but I'm getting <code>The payload is invalid.</code> </p>
  
  <p>error, that's what I do</p>
  
  <pre><code>App\Http\Kernel.php
       /**
       * The application's route middleware groups.
       *
       * @var array
       */
      protected $middlewareGroups = [
          'web' =&gt; [
              \App\Http\Middleware\EncryptCookies::class,
              \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
              \Illuminate\Session\Middleware\StartSession::class,
              // \Illuminate\Session\Middleware\AuthenticateSession::class,
              \Illuminate\View\Middleware\ShareErrorsFromSession::class,
              \App\Http\Middleware\VerifyCsrfToken::class,
              \Illuminate\Routing\Middleware\SubstituteBindings::class,
          ],
  
          'api' =&gt; [
              \App\Http\Middleware\EncryptCookies::class,
              \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
              \Illuminate\Session\Middleware\StartSession::class,
              \App\Http\Middleware\VerifyCsrfToken::class,
              'throttle:60,1',
              \Illuminate\Routing\Middleware\SubstituteBindings::class,
          ],
      ];
  </code></pre>
  
  <pre><code>App\Http\Controllers\Auth\AuthController.php
  
       /**
       * Get a JWT via given credentials.
       *
       * @return \Illuminate\Http\JsonResponse
       */
      public function login()
      {
          $credentials = request(['username', 'password']);
  
          if (!isset($credentials['username']) || !isset($credentials['password'])) {
              return response()-&gt;json('You need to fill username and password.', 401);
          }
          $user = User::where('username', '=', $credentials['username'])-&gt;first();
  
          if (!($user &amp;&amp; Hash::check($credentials['password'], $user-&gt;password))) {
              return response()-&gt;json('invalid_credentials', 401);
          }
          $token = JWTAuth::fromUser($user);
          $payload = JWTAuth::setToken($token)-&gt;getPayload();
          $cookie = Cookie::queue(Cookie::make('token', $token, config('jwt.ttl'), '/', null, true, true));
          return response()-&gt;json($user, 200);
      }
  </code></pre>
  
  <p>When i'm testing with Postman i can get </p>
  
  <pre><code>laravel_session, XSRF-TOKEN, token
  </code></pre>
  
  <p>cookies and login working without problem, on postman i'm getting cookie</p>
  
  <pre><code>pm.environment.set("xsrf-token", decodeURIComponent(pm.cookies.get("XSRF-TOKEN")))
  </code></pre>
  
  <p>with that code and adding headers to</p>
  
  <pre><code>X-XSRF-TOKEN: {{xsrf-token}}
  
  </code></pre>
  
  <p>with that code. When i'm doing post i'm getting</p>
  
  <pre><code>Illuminate\Contracts\Encryption\DecryptException: The payload is invalid. in file /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php on line 195
  </code></pre>
  
  <p>how we can fix that problem? Thank you very much for helping.</p>
  
  <p>Full Error:</p>
  
  <pre><code>Illuminate\Contracts\Encryption\DecryptException: The payload is invalid. in file /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php on line 195
  
  #0 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php(136): Illuminate\Encryption\Encrypter-&gt;getJsonPayload()
  #1 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(154): Illuminate\Encryption\Encrypter-&gt;decrypt()
  #2 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(136): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken-&gt;getTokenFromRequest()
  #3 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(74): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken-&gt;tokensMatch()
  #4 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken-&gt;handle()
  #5 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(56): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #6 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Session\Middleware\StartSession-&gt;handle()
  #7 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #8 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse-&gt;handle()
  #9 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(66): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #10 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Cookie\Middleware\EncryptCookies-&gt;handle()
  #11 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #12 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Routing/Router.php(683): Illuminate\Pipeline\Pipeline-&gt;then()
  #13 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Routing/Router.php(658): Illuminate\Routing\Router-&gt;runRouteWithinStack()
  #14 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Routing/Router.php(624): Illuminate\Routing\Router-&gt;runRoute()
  #15 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Routing/Router.php(613): Illuminate\Routing\Router-&gt;dispatchToRoute()
  #16 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(170): Illuminate\Routing\Router-&gt;dispatch()
  #17 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\Foundation\Http\Kernel-&gt;Illuminate\Foundation\Http\{closure}()
  #18 /home/vagrant/project/vendor/fruitcake/laravel-cors/src/HandleCors.php(31): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #19 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Fruitcake\Cors\HandleCors-&gt;handle()
  #20 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #21 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\TransformsRequest-&gt;handle()
  #22 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #23 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\TransformsRequest-&gt;handle()
  #24 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #25 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\ValidatePostSize-&gt;handle()
  #26 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(63): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #27 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode-&gt;handle()
  #28 /home/vagrant/project/vendor/fideloper/proxy/src/TrustProxies.php(57): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #29 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Fideloper\Proxy\TrustProxies-&gt;handle()
  #30 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\Pipeline\Pipeline-&gt;Illuminate\Pipeline\{closure}()
  #31 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(145): Illuminate\Pipeline\Pipeline-&gt;then()
  #32 /home/vagrant/project/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(110): Illuminate\Foundation\Http\Kernel-&gt;sendRequestThroughRouter()
  #33 /home/vagrant/project/public/index.php(55): Illuminate\Foundation\Http\Kernel-&gt;handle()
  #34 {main}
  </code></pre>