title: api endpoint not doing CSRF token validation on Sanctum - CSRF Token Mismatch
body: <p>I am currently learning Laravel (which is not going particularly smoothly) and I have got a couple of routes configured to test authentication using sanctum.</p>
  <p>I am building an API only laravel service with the plan that a ReactJS project will utilise the API.</p>
  <p>I am currently though not using ReactJS and using Insomnia REST client to test the API.</p>
  <p>I have a route for registering a new user, logging and then another route that just returns the authenticated user to prove that the authentication mechanism is working correctly.</p>
  <p>I don't know too much about CSRF but my understanding is I request a new CSRF token and then for every request to the API this CSRF token is used, so for example when I login and then get the authenticated user from the corresponding route, the CSRF token cookie is also sent, and therefore if a different CSRF token is sent, I should get a token mismatch error.</p>
  <p>I am testing this using Insomnia by sending a request to /sanctum/csrf-cookie which returns me back a 204 and Insomnia sets 3 cookies, one of which being an XSRF-TOKEN which I understand is an encrypted form of the CSRF token.</p>
  <p>I then login successfully and then when I call my route to get the authenticated user, I modify or delete the XSRF-TOKEN cookie and send the request, when I would then expect to get an error about the token not matching but this doesn't seem to be the case and I get a valid response back.</p>
  <p>Below is my api.php (I'm grouping various routes into separate PHP files to keep things organised when I come to actually building the API)</p>
  <pre><code>Route::prefix('/auth')-&gt;group(__DIR__ . '/endpoints/auth.php');
  
  Route::middleware('auth:sanctum')-&gt;get('/me', function(){
      //return response(null, 200);
      return auth()-&gt;user();
  });
  </code></pre>
  <p>In my <code>/endpoints/auth.php</code> I have the following:</p>
  <pre><code>Route::post('/register', [UserController::class, &quot;register&quot;]);
  
  Route::post('/login', [UserController::class, &quot;login&quot;]);
  
  Route::middleware('auth:sanctum')-&gt;post('/logout', [UserController::class, 'logout']);
  </code></pre>
  <p>So in the code above, when I send a request to <code>/api/me</code> after changing or deleting my XSRF-TOKEN I would expect the token mismatch but I am actually getting a 200 OK with the authenticated user details.</p>
  <p><strong>UPDATE</strong></p>
  <p>I've managed to make some progress.</p>
  <p>I've added the following items to the App/Http/Kernel.php under the api array as follows:</p>
  <pre><code>'api' =&gt; [
              \App\Http\Middleware\EncryptCookies::class,
              \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
              \Illuminate\Session\Middleware\StartSession::class,
              \Illuminate\Session\Middleware\AuthenticateSession::class,
              \Illuminate\View\Middleware\ShareErrorsFromSession::class,
              \App\Http\Middleware\VerifyCsrfToken::class,
              \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
              'throttle:api',
              \Illuminate\Routing\Middleware\SubstituteBindings::class,
          ],
  </code></pre>
  <p>When I attempt to submit the login request I now get an HTTP 419 with the error CSRF token mismatch.</p>
  <p>So I've made progress that it now seems to be attempting the CSRF validation, but now it always says there's a mismatch even though its sending the same XSRF-TOKEN cookie in the request.</p>