Kong / Kong/insomnia

Laravel XSRF-TOKEN cookie being stored with URL encoding incorrectly

Open
#3,482 15 comments 0 reactions 0 assignees View on GitHub
A-encoding B-bug S-verified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

When working with Laravel API project using Sanctum for authentication and CSRF protection, when the XSRF-TOKEN is stored in the cookie store, it seems to be URL encoded incorrectly as the cookie string usually ends in = but Insomnia stores it as %3D.

For example, I get the following XSRF-TOKEN received and stored in the Insomnia Cookie Store

eyJpdiI6Iml5YWEreGVaYUw0WGc2QmxlVEhQOGc9PSIsInZhbHVlIjoieVU2bmdyTjMyNFM0d0dnb3RsM24rMDFhRnJNWHVLcGg2SU9YMHh5dW8yaTZSTWcxbGxtSFdaK0I5MzB4Ymc4QWZWSzhjN2R6Y1RUTTc0d1VIY2FUaVhGMVE4bzQvWVBmL1YvajAwY3ZUNlZ4VEZIRk12cloyV0owVmNYOUxEZTIiLCJtYWMiOiI4OTUyN2U1MGI3NmUyMjEzZjgyNDcxMjAwYmViYjRkNzAwYmQ1YWUxOGY5NTYyNTVhZDczMmQ0ZjdlNjQwMGFhIn0%3D

When it should be

eyJpdiI6Iml5YWEreGVaYUw0WGc2QmxlVEhQOGc9PSIsInZhbHVlIjoieVU2bmdyTjMyNFM0d0dnb3RsM24rMDFhRnJNWHVLcGg2SU9YMHh5dW8yaTZSTWcxbGxtSFdaK0I5MzB4Ymc4QWZWSzhjN2R6Y1RUTTc0d1VIY2FUaVhGMVE4bzQvWVBmL1YvajAwY3ZUNlZ4VEZIRk12cloyV0owVmNYOUxEZTIiLCJtYWMiOiI4OTUyN2U1MGI3NmUyMjEzZjgyNDcxMjAwYmViYjRkNzAwYmQ1YWUxOGY5NTYyNTVhZDczMmQ0ZjdlNjQwMGFhIn0=

Notice the = on the end as it should be instead of %3D which is what insomnia stores it as so this needs to be modified and manually updated each time to ensure Laravel can perform the CSRF protection.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Laravel Sanctum flow described in the issue and inspect how the Insomnia Cookie Store serializes the XSRF-TOKEN value. Compare the stored cookie with the received value, especially the final '=' versus '%3D'. Done means the cookie is stored in a form Laravel accepts for CSRF protection.

Written by the indexing model from the issue text.

Assessment

Tech stack
laravel, typescript
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.