# Set SESSION_DOMAIN for a Vue app

> Leave SESSION_DOMAIN empty on one host. Set the parent domain only when Vue and Laravel are real subdomains.

- URL: https://laravel-vuejs.space/laravel-session-domain-vue
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs, Sanctum

People searching “Laravel session domain Vue” set `SESSION_DOMAIN=.localhost` because a production snippet said to use a leading dot. The cookie is never stored. Login looks successful and the next request is a guest.

> **TL;DR**
>
> -   Leave SESSION\_DOMAIN empty on one host.
> -   Set the parent domain only when Vue and Laravel are real subdomains.
> -   Do not set the domain in a Vue cookie.
>
> **Who it's for:** Laravel + Vue developers
>
> **Applies to:** Laravel 13 · Vue 3 · Sanctum

## The fix

The [CORS guide](https://laravel-vuejs.space/laravel-vue-cors) and the [Sanctum guide](https://laravel-vuejs.space/laravel-sanctum-vue-spa) both say to leave it empty on localhost. This page is the production choice.

Same host, Inertia, one site:

```ini
SESSION_DOMAIN=
```

Vue on `app.example.com` and Laravel on `example.com`:

```ini
SESSION_DOMAIN=.example.com
SANCTUM_STATEFUL_DOMAINS=app.example.com
```

The leading dot is the parent domain, so both hosts receive the cookie. `localhost` is not a parent domain you can prefix. `127.0.0.1` and `localhost` are also not the same host. Pick the one the browser shows and use it in `APP_URL` too.

## What to avoid

> **Gotcha**
>
> Do not set the domain in a Vue cookie. The session cookie is HttpOnly. JavaScript is not supposed to see it.

## FAQ

**Q: How do I set SESSION_DOMAIN for a Vue app?**

Leave SESSION\_DOMAIN empty on one host. Set the parent domain only when Vue and Laravel are real subdomains.

**Q: What goes wrong with Laravel session domain Vue?**

Many developers set \`SESSION\_DOMAIN=. Do not set the domain in a Vue cookie.