Added: support for csrf tokens that apply automatically

[james2doyle]

These additions allow supporting CSRF tokens for apps using Laravel Sanctum. You can provide a URL that gives you the token, which it then applies, to each URL being called.

This should address #243.

There are probably some docs updates here just to call this feature out, but I can do these when/if this is accepted.

[shalvah]

Honestly don't know if this works, because I don't use Sanctum, but I'll take your word for it (although I will test that non-Sanctum still works). Nice work, but a few notes.

Instructions for updating docs: https://scribe.knuckles.wtf/laravel/contributing#updating-documentation. At the very least, you'll need to update the config reference and add a section called "CSRF and Laravel Sanctum" under this. Do your best but don't obsess over the details, since I'll probably make some finishing touches.

[shalvah]

Thanks! Please update the docs.

[james2doyle]

Great! Got a PR open here: knuckleswtf/scribe-docs#4

[shalvah]

I made some changes to the code you pushed: a56eafe. It seems good, but you should pull and verify that it works for you.

Also, I changed the default value of csrf_cookie_name` to match what Laravel's docs say:

During this request, Laravel will set an XSRF-TOKEN cookie containing the current CSRF token. This token should then be passed in an X-XSRF-TOKEN header on subsequent requests

Apparently, the csrf_cookie_name that Laravel sets is by default XSRF-TOKEN, not X-XSRF-TOKEN (that is the header/cookie that we set.

And now I'm wondering if we need that csrf_cookie_name setting at all. I don't see any way to change the CSRF token Sanctum uses, so I think that setting is not needed.

[shalvah]

removing the csrf_cookie_name in 249e6e6. I see that it may be useful for other non-Sanctum SPA systems, but that means we'd also have to add csrf_header_name too, and I want to keep things simple for now. The CSRF URL is the one that's most likely to vary, so I'll keep only that for now.

Okay, closing shop for now, so I've tagged v3.1.0.0. Let me know if something's broken.