People searching “Laravel session domain Vue” set SESSION_DOMAIN=.localhost because a production snippet said to use a leading dot. The cookie is never stored. Login looks successful and the next request is a guest.
TL;DR
- Leave SESSION_DOMAIN empty on one host.
- Set the parent domain only when Vue and Laravel are real subdomains.
- Do not set the domain in a Vue cookie.
The fix#
The CORS guide and the Sanctum guide both say to leave it empty on localhost. This page is the production choice.
Same host, Inertia, one site:
SESSION_DOMAIN=Vue on app.example.com and Laravel on example.com:
SESSION_DOMAIN=.example.com
SANCTUM_STATEFUL_DOMAINS=app.example.comThe leading dot is the parent domain, so both hosts receive the cookie. localhost is not a parent domain you can prefix. 127.0.0.1 and localhost are also not the same host. Pick the one the browser shows and use it in APP_URL too.
What to avoid#
Gotcha
Do not set the domain in a Vue cookie. The session cookie is HttpOnly. JavaScript is not supposed to see it.
FAQ#
How do I set SESSION_DOMAIN for a Vue app?
Leave SESSION_DOMAIN empty on one host. Set the parent domain only when Vue and Laravel are real subdomains.
What goes wrong with Laravel session domain Vue?
Many developers set `SESSION_DOMAIN=. Do not set the domain in a Vue cookie.
