Sanctum SPA Authentication (CSRF protection) got HTTP status 401

[anwarx4u]

Describe the bug Hi all, I am using the Sanctum SPA Authentication (CSRF protection) system for my application Authentication. It is working well. But I am unable to authenticate broadcasting.

The following process is being used:

Middleware : Broadcast::routes(['middleware' => ['auth:sanctum']]);

laravel-echo-server.json

{ 
        "authHost": "https://web.test",
	"authEndpoint": "/broadcasting/auth",
	"clients": [],
	"database": "redis",
	"databaseConfig": {
		"redis": {},
		"sqlite": {
			"databasePath": "/database/laravel-echo-server.sqlite"
		}
	},
	"devMode": true,
	"host": null,
	"port": "6002",
	"protocol": "https",
	"socketio": {},
	"secureOptions": 67108864,
    "sslCertPath": "/Users/macbook/.config/valet/Certificates/web.test.crt",
    "sslKeyPath": "/Users/macbook/.config/valet/Certificates/web.test.key",
    "sslCertChainPath": "/Users/macbook/.config/valet/Certificates/web.test.csr",
	"sslPassphrase": "",
	"subscribers": {
		"http": true,
		"redis": true
	},
	"apiOriginAllow": {
		"allowCors": true,
		"allowOrigin": "",
		"allowMethods": "",
        "allowHeaders": "Origin, Content-Type, X-Auth-Token, X-Requested-With, Accept, Authorization, X-CSRF-TOKEN, X-Socket-Id"
	}
}

Bootstrap.js

import Echo from 'laravel-echo'; window.io = require('socket.io-client');

var lv_echo_port = process.env.MIX_LARAVEL_ECHO_PORT ? process.env.MIX_LARAVEL_ECHO_PORT: 6001;
window.Echo = new Echo({
    broadcaster: "socket.io",
    host: window.location.hostname + ":"+ lv_echo_port,
    withCredentials: true,
    auth: {
        headers: {
            'Referer': window.location.hostname
        }
    },
});

Error laravel-echo-server start

I am getting the following errors where I run the above command

Am I doing something wrong? Please suggest me regarding this..

Thanks in advance.

Anwar

[HalfBottleOfMind]

Hi, try Broadcast::routes(['middleware' => ['web']]);. Don't know why, but it helps for me.

[anwarx4u]

@HalfBottleOfMind

Yea, I knew it will work!
Actually, "web" middleware does not check users' authentication. It works only on the public channel. that's why there have no 401/403 errors! But I have some broadcasting channel which is required authentication and authorization.

So, I need an authentication middleware which already mentioned at Laravel docx

[anwarx4u]

@tlaverdure @taylorotwell

Can you help me regarding this, please

[Ken-vdE]

bump

[martio]

Try: Broadcast::routes(['middleware' => ['api', 'auth:sanctum']]);

[Naghal]

I have the same issue, have you got it working?

Edit: I moved my Broadcast::routes(['middleware' => ['auth:sanctum']]); to api.php instead ofthe BroadcastServiceProvider and it all works now.