this question has been asked a couple of times but it seems that no one has been able to solve it for real i.e. "it works on remote", "problem solved by changing 'file' to 'cookie'" etc. etc. but after 2 days (I'm still new to Laravel) of try & error still not able to fix this...
A - the setup:
- from scratch installed Laravel 8.36.2 via
laravel new designs --jeton a Mac running OS X 10.15.7 - installed debug bar via
composer require barryvdh/laravel-debugbar --dev - running on a local
brew install httpdinstallation of Apache/2.4.46 - MySQL Ver 8.0.23 for osx10.15 on x86_64 (Homebrew as well)
- accessing the application via designs.test (domain pointing to 127.0.0.1 in /etc/hosts)
B - Laravel config:
.env
APP_NAME=Designs
APP_ENV=local
APP_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
APP_DEBUG=true
APP_URL=http://www.designs.test
APP_STATIC_URL=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
LOG_CHANNEL=stack
LOG_LEVEL=debug
DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DB_USERNAME=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DB_PASSWORD=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
BROADCAST_DRIVER=log
CACHE_DRIVER=file
QUEUE_CONNECTION=sync
SESSION_DRIVER=database
SESSION_LIFETIME=120
MEMCACHED_HOST=127.0.0.1
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379
MAIL_MAILER=smtp
MAIL_HOST=mailhog
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=null
MAIL_FROM_NAME="${APP_NAME}"
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_APP_CLUSTER=mt1
MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
app/config/app.php
// Application Name
'name' => env('APP_NAME', 'Designs'),
// Application Environment
'env' => env('APP_ENV', 'development'),
// Application Debug Mode
'debug' => (bool) env('APP_DEBUG', true),
// Application URL
'url' => env('APP_URL', 'http://www.designs.test'),
'asset_url' => env('ASSET_URL', null),
// Application Timezone
'timezone' => 'UTC',
//Application Locale Configuration
'locale' => 'en',
// Application Fallback Locale
'fallback_locale' => 'en',
// Faker Locale
'faker_locale' => 'en_US',
// Encryption Key
'key' => env('APP_KEY'),
'cipher' => 'AES-256-CBC',
// Autoloaded Service Providers
'providers' => [
Illuminate\Auth\AuthServiceProvider::class,
Illuminate\Broadcasting\BroadcastServiceProvider::class,
Illuminate\Bus\BusServiceProvider::class,
Illuminate\Cache\CacheServiceProvider::class,
Illuminate\Foundation\Providers\ConsoleSupportServiceProvider::class,
Illuminate\Cookie\CookieServiceProvider::class,
Illuminate\Database\DatabaseServiceProvider::class,
Illuminate\Encryption\EncryptionServiceProvider::class,
Illuminate\Filesystem\FilesystemServiceProvider::class,
Illuminate\Foundation\Providers\FoundationServiceProvider::class,
Illuminate\Hashing\HashServiceProvider::class,
Illuminate\Mail\MailServiceProvider::class,
Illuminate\Notifications\NotificationServiceProvider::class,
Illuminate\Pagination\PaginationServiceProvider::class,
Illuminate\Pipeline\PipelineServiceProvider::class,
Illuminate\Queue\QueueServiceProvider::class,
Illuminate\Redis\RedisServiceProvider::class,
Illuminate\Auth\Passwords\PasswordResetServiceProvider::class,
Illuminate\Session\SessionServiceProvider::class,
Illuminate\Translation\TranslationServiceProvider::class,
Illuminate\Validation\ValidationServiceProvider::class,
Illuminate\View\ViewServiceProvider::class,
App\Providers\AppServiceProvider::class,
App\Providers\AuthServiceProvider::class,
// App\Providers\BroadcastServiceProvider::class,
App\Providers\EventServiceProvider::class,
App\Providers\RouteServiceProvider::class,
App\Providers\FortifyServiceProvider::class,
App\Providers\JetstreamServiceProvider::class,
],
// Class Aliases
'aliases' => [
'App' => Illuminate\Support\Facades\App::class,
'Arr' => Illuminate\Support\Arr::class,
'Artisan' => Illuminate\Support\Facades\Artisan::class,
'Auth' => Illuminate\Support\Facades\Auth::class,
'Blade' => Illuminate\Support\Facades\Blade::class,
'Broadcast' => Illuminate\Support\Facades\Broadcast::class,
'Bus' => Illuminate\Support\Facades\Bus::class,
'Cache' => Illuminate\Support\Facades\Cache::class,
'Config' => Illuminate\Support\Facades\Config::class,
'Cookie' => Illuminate\Support\Facades\Cookie::class,
'Crypt' => Illuminate\Support\Facades\Crypt::class,
'Date' => Illuminate\Support\Facades\Date::class,
'DB' => Illuminate\Support\Facades\DB::class,
'Eloquent' => Illuminate\Database\Eloquent\Model::class,
'Event' => Illuminate\Support\Facades\Event::class,
'File' => Illuminate\Support\Facades\File::class,
'Gate' => Illuminate\Support\Facades\Gate::class,
'Hash' => Illuminate\Support\Facades\Hash::class,
'Http' => Illuminate\Support\Facades\Http::class,
'Lang' => Illuminate\Support\Facades\Lang::class,
'Log' => Illuminate\Support\Facades\Log::class,
'Mail' => Illuminate\Support\Facades\Mail::class,
'Notification' => Illuminate\Support\Facades\Notification::class,
'Password' => Illuminate\Support\Facades\Password::class,
'Queue' => Illuminate\Support\Facades\Queue::class,
'Redirect' => Illuminate\Support\Facades\Redirect::class,
// 'Redis' => Illuminate\Support\Facades\Redis::class,
'Request' => Illuminate\Support\Facades\Request::class,
'Response' => Illuminate\Support\Facades\Response::class,
'Route' => Illuminate\Support\Facades\Route::class,
'Schema' => Illuminate\Support\Facades\Schema::class,
'Session' => Illuminate\Support\Facades\Session::class,
'Storage' => Illuminate\Support\Facades\Storage::class,
'Str' => Illuminate\Support\Str::class,
'URL' => Illuminate\Support\Facades\URL::class,
'Validator' => Illuminate\Support\Facades\Validator::class,
'View' => Illuminate\Support\Facades\View::class,
],
app/config/session.php
// Default Session Driver
'driver' => env('SESSION_DRIVER', 'database'),
// Session Lifetime
'lifetime' => env('SESSION_LIFETIME', 120),
'expire_on_close' => false,
// Session Encryption
'encrypt' => false,
//Session File Location
'files' => storage_path('framework/sessions'),
// Session Database Connection
'connection' => env('SESSION_CONNECTION', null),
// Session Database Table
'table' => 'sessions',
// Session Cache Store
'store' => env('SESSION_STORE', null),
// Session Sweeping Lottery
'lottery' => [2, 100],
// Session Cookie Name
'cookie' => env(
'SESSION_COOKIE',
Str::slug(env('APP_NAME', 'laravel'), '_').'_session'
),
// Session Cookie Path
'path' => '/',
// Session Cookie Domain
'domain' => env('SESSION_DOMAIN', 'localhost.com'),
// HTTPS Only Cookies
'secure' => env('SESSION_SECURE_COOKIE'),
// HTTP Access Only
'http_only' => true,
// Same-Site Cookies
'same_site' => 'lax',
routes/web.php
use Illuminate\Support\Facades\Route;
use App\Http\Controllers\HomeController;
// Web Routes
Route::get('/', [HomeController::class, 'test']);
app/Http/Controllers/HomeController.php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
class HomeController extends Controller {
public function test() {
return view('empty');
}
}
VIEWS & Layouts
resources/views/layouts/boilerplate.blade.php
<!doctype html>
<html lang="{{ str_replace('_', '-', app()->getLocale()) }}">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="csrf-token" content="{{ csrf_token() }}">
<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap">
<link href="{{ asset('css/app.css') }}" rel="stylesheet">
<title>Document Title</title>
</head>
<body>
@yield('content')
</body>
</html>
resources/views/empty.blade.php
@extends('layouts.boilerplate')
@section('content')
<p>This is my body content.</p>
@endsection
THE PROBLEM
each time you access the / route (i.e. reload the page after a second or two), Laravel will generate a new Session in the DB:
The problem get's really big if you going to request some data via an AJAX call to the same domain API and provide the token to compare it on the backend - Laravel will generate a new session as well as a new token and return a mismatch of the provided with 'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
QUESTION
WHAT THE HELL AM I MISSING?!? Any help highly ... HIGHLY appreciated and I'm more then willing to write a "how-to" for all the others that face the same problem and there are a few...