diff --git a/config/sanctum.php b/config/sanctum.php index 764a82fa..aa7d874e 100644 --- a/config/sanctum.php +++ b/config/sanctum.php @@ -21,6 +21,19 @@ Sanctum::currentApplicationUrlWithPort() ))), + /* + |-------------------------------------------------------------------------- + | Include Request Host as stateful domain + |-------------------------------------------------------------------------- + | + | In most cases frontend SPA implementations call API endpoints on the + | same domain name the SPA is hosted from. This parameter enables + | you to dynamically include the request host as stateful domain. + | + */ + + 'same_domain_stateful' => env('SANCTUM_SAME_DOMAIN_STATEFUL', false), + /* |-------------------------------------------------------------------------- | Sanctum Guards diff --git a/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php b/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php index 5bb02c27..4fb4be06 100644 --- a/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php +++ b/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php @@ -83,6 +83,10 @@ public static function fromFrontend($request) $stateful = array_filter(config('sanctum.stateful', [])); + if(config('sanctum.same_domain_stateful')) { + $stateful[] = $request->getHttpHost(); + } + return Str::is(Collection::make($stateful)->map(function ($uri) { return trim($uri).'/*'; })->all(), $domain); diff --git a/tests/Feature/EnsureFrontendRequestsAreStatefulTest.php b/tests/Feature/EnsureFrontendRequestsAreStatefulTest.php index 852d1035..93bb5cc6 100644 --- a/tests/Feature/EnsureFrontendRequestsAreStatefulTest.php +++ b/tests/Feature/EnsureFrontendRequestsAreStatefulTest.php @@ -59,6 +59,19 @@ public function test_request_origin_fallback() $this->assertTrue(EnsureFrontendRequestsAreStateful::fromFrontend($request)); } + public function test_same_domain_stateful() + { + $request = Request::create('https://app-domain.com/'); + $request->headers->set('origin', 'app-domain.com'); + + config(['sanctum.same_domain_stateful' => false]); + $this->assertFalse(EnsureFrontendRequestsAreStateful::fromFrontend($request)); + + config(['sanctum.same_domain_stateful' => true]); + $this->assertTrue(EnsureFrontendRequestsAreStateful::fromFrontend($request)); + + } + public function test_wildcard_matching() { $request = Request::create('/');