Feature to treat same domain requests to be from frontend and make stateful #564
Conversation
…as a domain to be included in the stateful domain list.
denjaland
changed the title
|
@denjaland I wonder if we could have a |
|
@taylorotwell, yes that does make sense, and that was actually my first approach as well. At some point however, I didn't go forward with it because configuration is cached, and I can't include the dynamic host into the stateful list. I'm not sure whether you have a standard pattern to use such fixed tokens, so please let me know if you prefer this differently. |
|
(I just noticed you actually proposed using a token now LOL - apparently I didn't read beyond your first sentence; I guess I had too many easter eggs ;-) ) |
…thPort() and Sanctum::currentRequestHost() work in a similar way by prepending the url or placeholder with a comma.
|
@denjaland please add the documentation for this |
Since there is no documentation on the use of Sanctum::currentRequestHost(), I followed example and didn't create a PR for addinv it into the docs. I noticed however thag @taylorotwell removed the little documentation I added into the config file, so I agree that maybe we should add it to the documentation. Shall I create a PR, @taylorotwell, meanwhile documenting the currejtRequestHost helper as well? |
Adds documentation to the Sanctum helper functions.
|
@siarheipashkevich I went ahead and created the PR at laravel/docs#10350. |
* Documents changes in laravel/sanctum#564 Adds documentation to the Sanctum helper functions. * Update sanctum.md --------- Co-authored-by: Taylor Otwell <[email protected]>
Our application is running under multiple domain names (multi tenant), each domain name hosting an SPA which communicates to the API endpoints under their own domain name as well.
In order to make sure that Sanctum recognizes these incoming requests as coming from the frontend, today we can only add them to the configuration file, which is cached, and which makes it cumbersome when we want to have that automatcally updated when a user adds a new domain name.
So we were looking into how we could resolve this by overriding the default behaviour of the middleware fromFrontend() method to dynamically check against the tenant host names in our database, but while doing so we actually came to the conclusion that in fact any call that is from the same domain (the referer / origin matches the request host), should be considered as being from the SPA frontend and therefore be made stateful.
Personally, I don't really see a case where this logic would not be applicable, and maybe this could be included into the standard behaviour, but as I'm sure this was thought through when implemented initially, I probably overlook a reason as to why you might not want this behaviour, so I made this PR backwards compatible, by adding a config parameter to enable this behaviour, so it remains disabled by default, and this can be released in a minor.