i’m using laravel 11 with laravel sanctum, i’ve config the sanctum as document. But at the first time i run in postman it’s return code 419 CSRF token mismatch. then i put some code into Pre-request of postman like this:

pm.sendRequest({
    url: 'http://localhost:8000/sanctum/csrf-cookie',
    method: 'GET',
}, function(error, response, {cookies}) {
    if(!error) {
        pm.collectionVariables.set('xsrf-cookie', cookies.get('XSRF-TOKEN'));
    }
});

then it can call to login api route. But now although i’ve cleaned cookies and comment the pre-request code, each time i hit the Send button, i run login api route without response 419 CSRF token mismatch. I don’t know why and when it will require xsrf-cookie in header of POST request?

Here is some of my config:

1. .env

SESSION_DOMAIN=.mydomain.local:4433,localhost,localhost:3000,127.0.0.1,127.0.0.1:8000
SANCTUM_STATEFUL_DOMAINS=.mydomain.local:4433,localhost,localhost:3000,127.0.0.1,127.0.0.1:8000

2. configsanctum.php

'guard' => ['api'],
'middleware' => [
        'authenticate_session' => LaravelSanctumHttpMiddlewareAuthenticateSession::class,
        'encrypt_cookies' => IlluminateCookieMiddlewareEncryptCookies::class,
        'validate_csrf_token' => IlluminateFoundationHttpMiddlewareValidateCsrfToken::class,
    ],

3. bootstrapapp.php

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        $middleware->statefulApi();
        $middleware->appendToGroup('api',[
            LaravelSanctumHttpMiddlewareEnsureFrontendRequestsAreStateful::class,
//            'throttle:api',
            IlluminateRoutingMiddlewareSubstituteBindings::class,
        ]);

    })

4. routesapi.php

Route::prefix('auth')->group(function () {
    Route::post('login', [AppHttpControllersAuthController::class, 'login']);
});

I’ve tried to find some answer on internet and compare with my configuration but nothing different.