Laravel sanctum csrf cookie every request?
Stefan Izdrail
Founder & Senior Architect · 2026-06-29
Title: Laravel Sanctum's Role in CSRF Protection and User Authentication
Introduction: Laravel Sanctum (previously known as Airlock) is a powerful authentication package that simplifies application development by providing token-based authentication, API support, and improved security. In this post, we explore its role in handling Cross-Site Request Forgery (CSRF) protection and user authentication.
Body:
1. Understanding Laravel Sanctum's CSRF Protection Mechanism
Laravel Sanctum is designed to protect your application against CSRF attacks by ensuring that each request comes from a trusted source. It requires two specific steps in the process, firstly initializing the CSRF protection through a GET request at `/sanctum/csrf-cookie` and then using an API token to authenticate the user in subsequent requests.
2. Initializing CSRF Protection via `/sanctum/csrf-cookie`
The first step in Laravel Sanctum is to establish a secure connection between the client and server by making a GET request at `/sanctum/csrf-cookie`. This response generates a unique CSRF token and sets CSRF protection for your application. By setting this cookie before any critical actions, you ensure that only trusted requests can perform these operations:
axios.get('/sanctum/csrf-cookie').then(response => {
// Login... });
Route::get('/login', function () {
return view('auth.login');
});
Route::post('/login', [LoginController@authenticate]);
// Install LaravelUI package via composer
composer require laravelcollective/html -> "*"
// Register service provider and add routes
Config::set('auth.guards', [
'web' => [
'driver' => 'session',
'provider' => 'users',
'login_path' => '/login',
'logout_url' => '/logout',
],
]);
Route::get('/', function () {
return view('welcome');
});
Route::get('/login', function () {
return redirect()->guest(route('auth.login'));
});