Dynamically includin the request http host as a stateful domain

config/sanctum.php

@@ -21,6 +21,19 @@
         Sanctum::currentApplicationUrlWithPort()
     ))),
 
+    /*
+    |--------------------------------------------------------------------------
+    | Include Request Host as stateful domain
+    |--------------------------------------------------------------------------
+    |
+    | In most cases frontend SPA implementations call API endpoints on the
+    | same domain name the SPA is hosted from.  This parameter enables
+    | you to dynamically include the request host as stateful domain.
+    |
+    */
+
+    'same_domain_stateful' => env('SANCTUM_SAME_DOMAIN_STATEFUL', false),
+
     /*
     |--------------------------------------------------------------------------
     | Sanctum Guards

src/Http/Middleware/EnsureFrontendRequestsAreStateful.php

@@ -83,6 +83,10 @@ public static function fromFrontend($request)
 
         $stateful = array_filter(config('sanctum.stateful', []));
 
+        if(config('sanctum.same_domain_stateful')) {
+            $stateful[] = $request->getHttpHost();
+        }
+
         return Str::is(Collection::make($stateful)->map(function ($uri) {
             return trim($uri).'/*';
         })->all(), $domain);

tests/Feature/EnsureFrontendRequestsAreStatefulTest.php

@@ -59,6 +59,19 @@ public function test_request_origin_fallback()
         $this->assertTrue(EnsureFrontendRequestsAreStateful::fromFrontend($request));
     }
 
+    public function test_same_domain_stateful()
+    {
+        $request = Request::create('https://app-domain.com/');
+        $request->headers->set('origin', 'app-domain.com');
+
+        config(['sanctum.same_domain_stateful' => false]);
+        $this->assertFalse(EnsureFrontendRequestsAreStateful::fromFrontend($request));
+
+        config(['sanctum.same_domain_stateful' => true]);
+        $this->assertTrue(EnsureFrontendRequestsAreStateful::fromFrontend($request));
+
+    }
+
     public function test_wildcard_matching()
     {
         $request = Request::create('/');