title: Getting 401 unauthorized for Laravel sanctum
body: <p>I am using Laravel Sanctum with Vuejs SPA. Both reside on same top level domain</p>
  
  <pre><code>Laravel backend : app.demo.localhost
  Vue SPA : app-spa.demo.localhost
  </code></pre>
  
  <p>Login and logout (endpoints) are working correctly when called from VueJS SPA using axios and XSRF-TOKEN is succesfully set, but when I call other api end points it gives me 401 unauthorized.</p>
  
  <p>In axios this is being set </p>
  
  <pre><code>axios.defaults.withCredentials = true;
  </code></pre>
  
  <p>I have the below configurations</p>
  
  <p>In Laravel .env</p>
  
  <pre><code>SESSION_DRIVER=cookie
  SESSION_DOMAIN=.demo.localhost
  SANCTUM_STATEFUL_DOMAINS=app-spa.demo.localhost
  </code></pre>
  
  <p>In Routes/Api.php</p>
  
  <pre><code>Route::middleware('auth:sanctum')-&gt;get('api/user', function (Request $request) {
     return $request-&gt;user();
  });
  </code></pre>
  
  <p>In cors.php</p>
  
  <pre><code>'paths' =&gt; ['api/*', 'sanctum/csrf-cookie', 'login', 'logout'],
  
  'allowed_methods' =&gt; ['*'],
  
  'allowed_origins' =&gt; ['*'],
  
  'allowed_origins_patterns' =&gt; [],
  
  'allowed_headers' =&gt; ['*'],
  
  'exposed_headers' =&gt; [],
  
  'max_age' =&gt; 0,
  
  'supports_credentials' =&gt; true,
  </code></pre>
  
  <p>Could someone help me out please?</p>