EnsureFrontendRequestsAreStateful::fromFrontend() does not extract host from referer

[plai2010]

• Sanctum Version: 2.3.3
• Laravel Version: 7.13.0
• PHP Version: 7.2.24
• Database Driver & Version:

Description:

The 'sanctum.stateful' configuration (by default SANCTUM_STATEFUL_DOMAINS in .env) specifies a list of hosts/domains. However, EnsureFrontendRequestsAreStateful::fromFrontend() uses HTTP referer with "http://" and "https://" removed to match against the list. This can yield incorrect result.

Steps To Reproduce:

False positive:

1. Set SANCTUM_STATEFUL_DOMAINS="example.com".
2. Access from "example.com.jp"; fromFrontend() accepts that.

False negative:

1. Set SANCTUM_STATEFUL_DOMAINS="*.example.com".
2. Access with HTTP referer "http://foobar.example.com/"; fromFrontend() rejects that (note ending '/' in referer).

[driesvints]

That indeed seems problematic.

Ping @taylorotwell

[RahulDey12]

I've added a PR regarding this problem