title: Laravel Sanctum CSRF Cookie Request Optional
body: <p>I am trying to use Laravel Sanctum for my SPA. There are some basic home pages from web.php routes but other <code>axios</code> API interactions with the SPA are in api.php routes guarded by <code>auth:sanctum</code></p>
  
  <p>From the official documentation (<a href="https://laravel.com/docs/7.x/sanctum#spa-authenticating" rel="nofollow noreferrer">https://laravel.com/docs/7.x/sanctum#spa-authenticating</a>), it says we have to send a request to <code>/sanctum/csrf-cookie</code> to initialize CSRF protection prior login. However, I noticed that even without login, Laravel by default already initialized <code>XSRF-TOKEN</code> and <code>&lt;app_name&gt;_session</code> cookies to my browser. I do not need to initialize it via <code>/sanctum/csrf-cookie</code> and my subsequent API request in the logged-in SPA still works. Later I checked <a href="https://laravel.com/docs/7.x/csrf#csrf-x-xsrf-token" rel="nofollow noreferrer">https://laravel.com/docs/7.x/csrf#csrf-x-xsrf-token</a> and it says it is the default behavior that Laravel will include the CSRF token in each response.</p>
  
  <p>My question is, is it true that <code>/sanctum/csrf-cookie</code> initialization is optional and it is safe for <code>axios</code> to use the default CSRF token return by Laravel? Or am I doing something wrong which exposes my SPA to CSRF attack?</p>