Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA Laravel Sanctum 419 usually means the browser’s CSRF token and session state are missing, stale, or not matching—not that the SPA should turn off CSRF protection. Trace the failing request from the browser first: confirm the SPA fetched /sanctum/csrf-cookie, then check its cookies and headers before changing middleware or domain settings.
1. Fetch the CSRF cookie before the protected request
For first-party SPA authentication, Sanctum uses Laravel’s session cookie and CSRF protection. Before login or another state-changing request, the SPA should request /sanctum/csrf-cookie. Laravel sets an XSRF-TOKEN cookie; the client must send its URL-decoded value in the X-XSRF-TOKEN header on the subsequent request. Axios and some other clients can do this automatically when configured for it. See the Laravel Sanctum documentation.
As an Amazon Associate I earn from qualifying purchases.
- In the browser’s Network panel, verify the CSRF-cookie request completes before the login or other POST.
- In the browser’s cookie panel, verify an
XSRF-TOKENcookie was set for the relevant host. - Inspect the later request to ensure the expected XSRF header is present; do not assume that merely making the initial request means the token was sent.
2. Check that the failing request carries matching state
Laravel’s CSRF middleware compares the request token with the token associated with the session. Inspect the failing request itself, not just the earlier cookie response: confirm it carries the session cookie and the corresponding XSRF token header. A cookie may be absent because it is scoped to another host, blocked, or stale. Laravel documents CSRF token verification in its CSRF protection guide and VerifyCsrfToken API reference.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Compare the frontend and API hostnames and schemes with the cookie’s domain and scope.
- Check the actual request’s cookies and headers in the Network panel for omissions or a token that no longer matches the session.
- Do not substitute a Sanctum personal access token for this browser session-and-CSRF flow.
3. Match stateful domains and middleware to the Laravel version
Sanctum must recognize the SPA’s origin as first-party and apply its stateful API middleware. Check the configured stateful domain list against the origin the browser actually uses; local development URLs may need their port included. Also confirm the middleware registration style matches the application’s Laravel generation. Laravel 11 and later document enabling this with statefulApi() in bootstrap/app.php; older application generations register middleware differently. Use the instructions for the version installed rather than transplanting a current setup into an older application. The versioned Sanctum guide also specifies that SPA and API must share a top-level domain, though they may use different subdomains.
#1 Best Overall
4. For separate subdomains, verify CORS credentials and cookie scope
When the SPA and API use separate subdomains, the browser must be allowed to make credentialed cross-origin requests, and the session cookie must cover both hosts. Laravel’s Sanctum guidance calls for enabling CORS credential support and configuring the browser client to send credentials and XSRF data. Its Axios example sets withCredentials and withXSRFToken to true. The guide’s cookie-domain example uses a leading-dot root domain; configure the equivalent for the real production domain rather than copying an example domain literally.
- Check the CORS configuration permits the SPA origin and credentials.
- Check that the client sends credentials and XSRF data on the API request.
- Check that the session cookie’s domain, HTTPS scheme, and scope fit the deployed SPA and API hosts.
5. Decide whether the session expired
If requests worked and the 419 appears after inactivity, session expiry becomes a plausible cause. Laravel’s Sanctum documentation says that when a user’s session expires due to inactivity, later requests may receive a 401 or 419 response. In that case, direct the user back to the SPA login page so they can authenticate again. If the failure occurs on every fresh attempt, investigate the preceding cookie, token, stateful-domain, middleware, and CORS checks first; that ordering follows the documented request flow, but it does not establish one universal cause for every 419.
Choose the Sanctum flow that matches the client
Sanctum provides separate mechanisms for first-party browser SPAs and API clients such as mobile or third-party applications. The debugging steps above apply to the first-party SPA flow; Laravel recommends that first-party SPAs use cookie-based authentication rather than API tokens.
| Client path | Credential mechanism | Browser credentials and CORS | Stateful origin configuration |
|---|---|---|---|
| First-party SPA | Session cookie with CSRF protection | Applies to cross-origin browser requests | SPA origin must be configured as stateful |
| Third-party or mobile API client | Personal access token, typically sent as a bearer token | Browser cookie credentials are not the authentication mechanism | Not the first-party SPA stateful-cookie flow |
Check the route’s middleware context
Do not move a failing route blindly between route files. Laravel 12 documents that routes in web.php receive session state, CSRF protection, and cookie encryption through the web middleware group, while routes in api.php are stateless by default. A Sanctum SPA request still depends on the stateful configuration and middleware described above. Inspect the middleware stack for the exact URL returning 419. See Laravel’s directory structure documentation alongside the Sanctum guide.
Quick Recap
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
