Rename domain CSRF Token in Cookies

[sindyko]

As an idea, we could introduce a variable to custom-name the cookie - for example, changing XSRF-TOKEN to XSRF-TOKEN-SITE-A.
I decided to try extending the class to attach internal cookies directly to the domain itself to avoid token conflicts.
For now, the only available workaround to resolve this situation is to use class inheritance/extending.

<?php

namespace App\Http\Middleware;

use Illuminate\Contracts\Encryption\Encrypter;
use Illuminate\Contracts\Foundation\Application;
use Illuminate\Contracts\Support\Responsable;
use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;
use Symfony\Component\HttpFoundation\Cookie;

class CustomPreventRequestForgery extends PreventRequestForgery
{
    public function __construct(Application $app, Encrypter $encrypter)
    {
        parent::__construct($app, $encrypter);
    }

    /**
     * Create a new "XSRF-TOKEN" cookie that contains the CSRF token.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  array  $config
     * @return \Symfony\Component\HttpFoundation\Cookie
     */
    protected function newCookie($request, $config)
    {
        $config['domain'] = config('session.domain_csrf', $request->getHost());

        return parent::newCookie($request, $config);
    }
}

and then override it in AppServiceProvider

public function register(): void
    {
        //
        $this->app->singleton(
            PreventRequestForgery::class,
            CustomPreventRequestForgery::class
        );
    }

If you are using Sanctum, add it to the middleware.

    'middleware' => [
        'authenticate_session' => AuthenticateSession::class,
        'encrypt_cookies' => EncryptCookies::class,
        'validate_csrf_token' => CustomPreventRequestForgery::class,
    ],

Also, I defined it in the config/session.php file.

    /*
    |--------------------------------------------------------------------------
    | Session Cookie Domain
    |--------------------------------------------------------------------------
    |
    | This value determines the domain and subdomains the session cookie is
    | available to. By default, the cookie will be available to the root
    | domain without subdomains. Typically, this shouldn't be changed.
    |
    */

    'domain' => env('SESSION_DOMAIN'),
    'domain_csrf' => env('SESSION_DOMAIN_CSRF'), // <- Custom property

and set it to null in .env to ensure proper cookie behavior.

SESSION_DOMAIN=.siteA.localhost
SESSION_COOKIE=_apiedupers
SESSION_DOMAIN_CSRF=null

In the end, it turns out something like this:

Name	Value	Domain
_idpers	eyJpdiI6InVneUFrZmh2RHBZMjBsdWV1Q...	.siteA.localhost
_eduapipers	eyJpdiI6InVneUFrZmh2RHBZMjBsdWV1Q...	.siteB.localhost
sso_logged_in	true	.siteA.localhost
XSRF-TOKEN	eyJpdiI6ImFBK1FybWZ4cE8ycVhFRWowM...	id.siteA.localhost

[henzeb]

Can you please write English? It would make it easier to help you.

[sindyko]

I translated the question/idea into English.