Laravel 7.5.2 (Passport Api) + Vuejs Error : Undefined index: aud , \vendor\laravel\passport\src\Guards\TokenGuard.php

[mhabib555]

• Passport Version: 9.0
• Laravel Version: 7.5.2
• PHP Version: 7.4.0
• Database Driver & Version:
• Database client version: libmysql - mysqlnd 7.4.0

Description:

I am using Laravel 7.5.2 with Vuejs. I am using passport for api authentication. I am getting the following error when sending ajax request to api

{
"message": "Undefined index: aud",
"exception": "ErrorException",
"file": "E:\\laravel\\vendor\\laravel\\passport\\src\\Guards\\TokenGuard.php",
"line": 140,
"trace": [
    {
...
}
]

Steps To Reproduce:

I have followed passport installation instruction on laravel website.

• Has run composer require laravel/passport, php artisan migrate and php artisan passport:install
• Has added HasApiTokens in user model
• Has added Passport::routes() in AuthServiceProvider
• Has added \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class in App\Http\Kernel web middlewareGroups
• Has changed Api driver to passport in config/auth.php

The cookie named "laravel_token" is getting generated and sent with ajax request as I can see in developer tool.

In my controller I have included api middleware as

public function __construct(){
    $this->middleware('auth:api');
}

[TullariS]

Same here

[MUHAMMADSiyab]

Facing the same issue

[Zae]

Having the same issue but with laravel 6 and passport 9.

[Zae]

I think I might have found the issue.

Looks like /vendor/laravel/passport/src/ApiTokenCookieFactory.php:77 sets the index sub into the JWT token

But when decoding the cookie and trying to find the corresponding user \Laravel\Passport\Guards\TokenGuard::$clients tries to use the index aud to find the user.

However, the indexes have been like that for a LONG time now, so I'm not sure why this is suddenly a problem?

[joelennon]

I suspect it might be due to the removal of old php-jwt versions in this merged PR? #1236

Reverting to 8.x branch resolved the issue for me.

composer require laravel/passport:^8.0

[lcobucci]

I think I might have found the issue.

Looks like /vendor/laravel/passport/src/ApiTokenCookieFactory.php:77 sets the index sub into the JWT token

But when decoding the cookie and trying to find the corresponding user \Laravel\Passport\Guards\TokenGuard::$clients tries to use the index aud to find the user.

However, the indexes have been like that for a LONG time now, so I'm not sure why this is suddenly a problem?

The problem isn't with the sub claim but the aud one. Which is being used to identify the client (while the sub is meant for the user). The audience is just not being configured.

[lcobucci]

Looking at the diff, this seems to be the culprit (as it apparently assumes that aud claim is always there).

@driesvints do you have any idea on how can we solve this?

[driesvints]

@lcobucci your link only shows all the commits between 8.5 and 9.0. Can you link to the specific file or pr that changed this?

[driesvints]

Did everyone here read the upgrade guide and added the new provider column to the clients table?

https://github.com/laravel/passport/blob/9.x/UPGRADE.md

[lcobucci]

I've updated it already, sorry

[lcobucci]

@driesvints column is there in my case (I'm doing a clean php artisan passport:install -n btw). Created entries have null as provider (not sure if it helps).

[joelennon]

Hey @driesvints yeah this was happening for me on a fresh project, provider column is there.

[driesvints]

It's mentioned that people are here using vue but I don't see any vuejs install steps in the steps to reproduce. Can anyone please post very specific steps to replicate this?

[akizor]

Hey, I'm on a fresh install also. On version 9.0 I'm encountering the same error, while reverting to 8.5 solves it. Not using vue but old plain XHR request with following headers. The cookies are sent also.

'X-Requested-With': 'XMLHttpRequest',
'X-CSRF-TOKEN': THE_CSRF_TOKEN