Laravel XSRF-TOKEN cookie being stored with URL encoding incorrectly
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
When working with Laravel API project using Sanctum for authentication and CSRF protection, when the XSRF-TOKEN is stored in the cookie store, it seems to be URL encoded incorrectly as the cookie string usually ends in = but Insomnia stores it as %3D.
For example, I get the following XSRF-TOKEN received and stored in the Insomnia Cookie Store
eyJpdiI6Iml5YWEreGVaYUw0WGc2QmxlVEhQOGc9PSIsInZhbHVlIjoieVU2bmdyTjMyNFM0d0dnb3RsM24rMDFhRnJNWHVLcGg2SU9YMHh5dW8yaTZSTWcxbGxtSFdaK0I5MzB4Ymc4QWZWSzhjN2R6Y1RUTTc0d1VIY2FUaVhGMVE4bzQvWVBmL1YvajAwY3ZUNlZ4VEZIRk12cloyV0owVmNYOUxEZTIiLCJtYWMiOiI4OTUyN2U1MGI3NmUyMjEzZjgyNDcxMjAwYmViYjRkNzAwYmQ1YWUxOGY5NTYyNTVhZDczMmQ0ZjdlNjQwMGFhIn0%3D
When it should be
eyJpdiI6Iml5YWEreGVaYUw0WGc2QmxlVEhQOGc9PSIsInZhbHVlIjoieVU2bmdyTjMyNFM0d0dnb3RsM24rMDFhRnJNWHVLcGg2SU9YMHh5dW8yaTZSTWcxbGxtSFdaK0I5MzB4Ymc4QWZWSzhjN2R6Y1RUTTc0d1VIY2FUaVhGMVE4bzQvWVBmL1YvajAwY3ZUNlZ4VEZIRk12cloyV0owVmNYOUxEZTIiLCJtYWMiOiI4OTUyN2U1MGI3NmUyMjEzZjgyNDcxMjAwYmViYjRkNzAwYmQ1YWUxOGY5NTYyNTVhZDczMmQ0ZjdlNjQwMGFhIn0=
Notice the = on the end as it should be instead of %3D which is what insomnia stores it as so this needs to be modified and manually updated each time to ensure Laravel can perform the CSRF protection.
Contributor guide
Research direction
Start by reproducing the Laravel Sanctum flow described in the issue and inspect how the Insomnia Cookie Store serializes the XSRF-TOKEN value. Compare the stored cookie with the received value, especially the final '=' versus '%3D'. Done means the cookie is stored in a form Laravel accepts for CSRF protection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- laravel, typescript
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100