Framework: VerifyCsrfToken doesn't play well with Responsables

Created on 3 Sep 2019 · 3Comments · Source: laravel/framework

Laravel Version: 5.8.34
PHP Version: 7.3
Database Driver & Version: MySQL 5.7.X

Description:

I'm seeing users getting this error:

Undefined property: Inertia\Response::$headers {"exception":"[object] (ErrorException(code: 0): Undefined property: Inertia\Response::$headers at …/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php:180)

The Inertia\Response class implements the Responsable interface.

When VerifyCsrfToken tries to add cookies to a Responsable object, it triggers an error. The problem is that if the Responsable hasn't been transformed to a response yet, the $headers property might not exist.

https://github.com/laravel/framework/blob/7b39e0825ce3c837e1cae6be6e821ce22cad3efd/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php#L180

We (temporarily) solved this by overwriting the method in our own VerifyCsrfToken middleware.

use Inertia\Response;

//

protected function addCookieToResponse($request, $response)
{
    if ($response instanceof Response) {
        $response = $response->toResponse($request);
    }

    return parent::addCookieToResponse($request, $response);
}

Shouldn't Laravel unwrap the Responsable before adding the cookie?