How to use with Sanctum? about laravel-graphql-playground HOT 2 CLOSED

I was able to solve this, by the way.

config/lighthouse.php

change 'gate' => null to 'gate' => 'sanctum'

Add EnsureFrontendRequestsAreStateful::class to the route.middleware config

config/graphql-playground.php

route.middleware I added the auth middleware to this, just so that I wouldn't have to get a CSRF cookie / manage login on the playground view. Obviously this could be adjusted to your needs.

Make sure you add this code to GraphQLPlayground.init as documented in the other CSRF protection docs:

settings: {
    'request.credentials': 'same-origin',
},
headers: {
    'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]').content
}

from laravel-graphql-playground.

Interested in this as well...it seems that the graphql requests don't send the "Referer" header, which Sanctum relies on to authenticate. If we inject the header in middleware, then it does authenticate, but that isn't secure. Wondering if there is a way to get the playground graphql calls to send the "Referer" which would seem to solve this.

from laravel-graphql-playground.