Hi,
After submitting the login form in a Laravel application (running behind Traefik as a reverse proxy), instead of being authenticated the user is redirected back to /login with URL parameters like _token=...&email=...&password=....
The cookies (laravel_session, XSRF-TOKEN) are being set and sent correctly (HttpOnly + Secure + SameSite=Lax), but Laravel does not seem to persist the session.
I have already configured APP_URL, SESSION_DOMAIN, SESSION_SECURE_COOKIE, and TrustProxies.
Traefik and the Laravel application are running as separate containers in Docker. Everything is hosted on an Ubuntu server as part of a training setup.
This also happens after logging out of the application.
Below are my current settings (they may look a bit strange because I tried several different configurations already). Unfortunately, nothing worked. I couldn’t find a similar case online, so I’m asking for help.
Traefik docker-compose
networks:
network_name:
external: true
name: network_name
services:
traefik:
container_name: traefik
image: traefik:latest
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./letsencrypt:/letsencrypt
command: |
--api.dashboard=true
--api.insecure=false
--providers.docker=true
--providers.docker.exposedbydefault=false
--providers.docker.network=network_name
--entrypoints.web.address=:80
--entrypoints.websecure.address=:443
--certificatesresolvers.myresolver.acme.httpchallenge=true
--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
--certificatesresolvers.myresolver.acme.email=${ACME_EMAIL}
--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
ports:
- 80:80
- 443:443
networks:
- network_name
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.rule=Host(\"${APP_TRAEFIK_HOST}\")"
- "traefik.http.routers.traefik.entrypoints=websecure"
- "traefik.http.routers.traefik.tls.certresolver=myresolver"
- "traefik.http.routers.traefik.service=api@internal"
- "traefik.http.routers.traefik.middlewares=auth"
- "traefik.http.routers.traefik.middlewares=auth@docker,secure-headers@docker"
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.middlewares.secure-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.middlewares.secure-headers.headers.sslRedirect=true"
Aplication, docker-compose
services:
nginx:
build:
context: ./.docker
dockerfile: nginx.dockerfile
args:
- UID=${UID:-1000}
- GID=${GID:-1000}
volumes:
- ./src:/var/www:delegated
depends_on:
- php-fpm
- mysql
networks:
- network_name
labels:
- "traefik.enable=true"
- "traefik.docker.network=network_name"
# Router
- "traefik.http.routers.project-name-nginx-secure.rule=Host(`${APP_HOST}`)"
- "traefik.http.routers.project-name-nginx-secure.entrypoints=websecure"
- "traefik.http.routers.project-name-nginx-secure.tls.certresolver=myresolver"
- "traefik.http.middlewares.project-name-headers.headers.sslredirect=true"
- "traefik.http.middlewares.project-name-headers.headers.stsseconds=315360000"
- "traefik.http.middlewares.project-name-headers.headers.stsincludesubdomains=true"
- "traefik.http.middlewares.project-name-headers.headers.stspreload=true"
- "traefik.http.routers.project-name-nginx-secure.middlewares=project-name-headers"
php-fpm:
container_name: project-name-php-fpm
hostname: project-name-php-fpm
build:
context: ./.docker
dockerfile: php.dockerfile
args:
- UID=${UID:-1000}
- GID=${GID:-1000}
ports:
- "9001:9000"
volumes:
- ./src:/var/www:delegated
networks:
- network_name
Nginx, .conf
server {
listen 80;
index index.php;
server_name _;
root /var/www/public;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass .project-name-php-fpm:9000;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param HTTP_X_FORWARDED_PROTO $http_x_forwarded_proto;
fastcgi_param HTTP_X_FORWARDED_HOST $host;
fastcgi_param HTTP_X_FORWARDED_FOR $proxy_add_x_forwarded_for;
fastcgi_read_timeout 300;
}
}