Resolving CSRF-Token Mismatch Issues in Axios with Laravel and Vue.js

---

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Axios sending double CSRF-Token [CSRF-Token mismatch]

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---

The Problem: Double CSRF Tokens

In a typical setup, your application would use Laravel's Sanctum for authenticating users. When users log in, the server generates a CSRF token that Axios should automatically handle. However, in some cases like yours, Axios might unintentionally send an old or expired CSRF token alongside the new one.

Example of the Issue

Your code is straightforward:

[[See Video to Reveal this Text or Code Snippet]]

When you check the DevTools/Network tab:

The csrf-cookie request shows that the response headers correctly contain a valid XSRF-TOKEN.

However, upon examining the login request, you might see:

SET-COOKIE property contains an old, expired token and the new valid token.

This leads to the confusion of why the old value appears when your code does not explicitly use it.

The Solution: Clearing Cookies on Logout

The root of the problem lies in the way cookies are handled. When a user logs out, if the old CSRF token remains in the document’s cookie store, it can be sent with subsequent requests, causing the mismatch.

Effective Steps to Resolve the Issue

Clear Cookies on Logout
Ensure that when a user logs out, all relevant cookies, including the old CSRF token, are cleared. This will prevent Axios from accidentally sending old or expired tokens in the header in future requests.

Here is a simple way to clear cookies:

[[See Video to Reveal this Text or Code Snippet]]

Correctly Configure Axios
Your Axios client seems to be set up correctly with withCredentials: true:

[[See Video to Reveal this Text or Code Snippet]]

Testing the Solution
After you implement the logout logic, make sure to thoroughly test the login process again. Verify that only the new CSRF token is being sent in your requests, eliminating the old value.

Conclusion

By following the outlined solution, you can focus on building features without being hindered by unnecessary authentication errors!

If you have further questions or need assistance with a different part of your setup, feel free to reach out!