Getting CSRF token mismatch on all post calls

[thecyrilcril]

I am getting "CSRF token mismatch" on all POST calls make via the documentation page

[bikash-kodiary]

Comment out \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class on Kernel.php file, if you are using scantum.

[rabol]

this is just a 'hack'
It would be nice with a real solution

[sprklinginfo]

I hope to use it for a legacy project (Laravel 9) with auth:sanctum for all APIs. I tried on the local and got "CSRF token mismatch" error too. I agree with @rabol that comments off EnsureFrontendRequestsAreStateful::class is a hack since I am planning to push to the production and control access with viewApiDocs gate. Are there any other solutions ? Thanks.

[layerok]

I've already done a pull request #336 to fix this problem. You can check how I've solved this problem.

[eznix86]

It is not in a release yet:

Do this to fetch the latest as of the time I write this:

composer require "dedoc/scramble:dev-main#d1d8e26dee3e9e408351b856c645d0af3bd454af" -W

[nerisonpitogo]

spent 2 days figuring this out and the solution that worked for me was adding the following in the env file.

SANCTUM_STATEFUL_DOMAINS=localhost

[daniel-hampton]

I'm running into this problem as well.

In my case it's specifically with Try It on routes that need Bearer tokens and the fact I have $middleware->statefulApi() enabled in bootstrap/app.php

I would like to keep stateful APIs because our front end does call the JSON APIs currently. But I'm currently disabling Try It on the documentation pages.

Is there a way to host the docs on a subdomain so Sanctum doesn't try to use CSRF checks?

Alternatively, is there a way to disable CSRF checks not on an API route, but based on requests coming from the /docs/api path?

[daniel-hampton]

For what it's worth, putting the docs on a subdomain or different domain does seem to work.

I had to add this to my AppServiceProvider and publish the cors config and allow credentials.

Scramble::registerUiRoute('/docs/api')
    ->domain('docs.example.com');
Scramble::registerJsonSpecificationRoute('/docs/api.json')
    ->domain('docs.example.com');

[romalytvynenko]

@daniel-hampton can you please try Scramble 0.11.15?

[daniel-hampton]

Sorry for the very delayed response. I'll try to check it out shortly. 😅

[romalytvynenko]

@daniel-hampton awesome 🤩

[stoykovnet]

Hi,

It works for me now.

My setup is also Stateful API using Sanctum.

I have updated to Scramble v0.11.31.

Thank you very much for support this case 🙏