我正在将旧的perl应用程序迁移到基于Laravel的新PHP版本。这需要perl应用程序向新的Laravel应用程序发出XHR请求，我在Chrome浏览器中遇到了一些麻烦，cookie被返回。
当已经登录到两个应用程序时，我试图向Laravel应用程序发出两个请求:第一个请求CSRF令牌，第二个使用该令牌发出POST请求。
我已经将CORS配置为可以正常发送和接收cookie，并且初始/令牌GET调用工作正确(根据XHR请求发送的cookie进行身份验证)
/token调用然后返回一个Set-Cookie头(如预期)与laravel_session cookie，但我的问题是，下面的POST请求是发送相同的cookie的两个版本，PHP似乎只看不正确的一个，从而加载错误的会话和测试对错误的CSRF令牌。
这是所有3个请求的详细信息-正如你可以看到的，最后的POST发送了两个版本的相同的cookie，具有不同的值。(为了清晰，在cookie头中添加了换行符)
这只发生在Chrome中，在Safari中它似乎发送正确的cookie和CSRF令牌被正确验证。Chrome版本为45.0.2454.101.
令牌请求报头:
GET /token HTTP/1.1
Host: laravel.domain.com
Connection: keep-alive
Accept: */ *
Origin: https://perl.domain.com
X-FirePHP-Version: 0.0.6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Referer: https://perl.domain.com/original/page.html
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: XSRF-TOKEN=eyJpdiI6Im5kSG02TVhsc08wUVZCZkd2WnZQa1E9PSIsInZhbHVlIjoiWFE0MXFBNlZIMnNXVHppXC9hN0dqNlJ2K1psUU9JZlFqTUdZZ3RJVmc0N1ZqV0MrVEczOGVFV0ExcDRDYmQxZDBTbFhGaWFiUkh5TGowOUgxdzVKOCtBPT0iLCJtYWMiOiJhOTYzNDFlZjUyYTdjMWFmMDE1MTFlMjczYTA0NTE2NThlYjVlNTkyOWUyZWNjZWM1MGYxODc4MmVjMTM5YTFhIn0%3D;
laravel_session=eyJpdiI6ImdSM0VTT25FUzZoY3JOeVwvN2JLWFFnPT0iLCJ2YWx1ZSI6Ilp3WHBFZlNuTnZibVMyMUlvbk1YM1YwdXF5VjRnTW1CNWVjUU1ReXlLZldSeEJxeTJFSmgyN2pyTjAydXlzMzE1TmJseWZrQmRraStDUkFqNTFReUp3PT0iLCJtYWMiOiI5MWMxM2YyNzFjOTY3ZjIxMmVjYmNlZWNlNDAzYjI2MjZkNmJhMzIyM2VlNTAwNGJlNTQ4OTU4OTMxZjJhYjE5In0%3D;
_ga=GA1.3.1924987937.1443461035;
_dc_gtm_UA-5119192-1=1
令牌响应头:
Access-Control-Allow-Credentials:true
Access-Control-Allow-Origin:https://perl.domain.com
Cache-Control:no-cache
Connection:Keep-Alive
Content-Length:40
Content-Type:text/plain; charset=UTF-8
Date:Mon, 28 Sep 2015 17:24:18 GMT
Keep-Alive:timeout=2, max=80
P3P:policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa CUSa PSAa IVAa CONo OUR IND UNI STA"
Server:Apache
Set-Cookie:XSRF-TOKEN=eyJpdiI6ImFiT3ZSWWVDUnlKcWMraGFrWnBVY2c9PSIsInZhbHVlIjoiOTVnc05UM3puVGRwTUNUbDl3T1FNTVpWdGxVM29VaHNLSUt0XC9LTkhzMG5iOGlNbmhHXC9KMDBBTW9qRjZFQXZaSmlHTmhKUVpmTGdpXC80K0lkSUhUdnc9PSIsIm1hYyI6IjI5Njc1ZWE2NTRiYTY4NWJhMmE5Y2UwNjBlZDRkOWE4OGQwOWQ5NjE1YjAyNTMwNTFmZDczY2RjNzRiNjExNDIifQ%3D%3D; expires=Mon, 28-Sep-2015 19:24:23 GMT; Max-Age=7200; path=/
Set-Cookie:laravel_session=eyJpdiI6IjJqbTRyWG1GOEd1c2NIRnd4eE4yMGc9PSIsInZhbHVlIjoiZzk2SFE2emxcL0xGNjI3aGtYd1NmWURUVEduMVZVY2dYeUlRTVo2UTYyU0I2dFljalhxTjJSY3JFMGpvXC9nc2N0N3dJUFZYbGQya3pUNit1eWtrM3JqZz09IiwibWFjIjoiNDBhYzAzZjkwNDA5ZDE4Y2Y5ZjQ1MjdiYTUwYWU2M2Y5NjVjY2I1ZmMxZWFlMzAwZWM4MmVjNWRlYjM2Yjc2ZSJ9; expires=Mon, 28-Sep-2015 19:24:23 GMT; Max-Age=7200; path=/; httponly
Vary:Origin
X-Powered-By:PHP/5.5.9-1ubuntu4.11
预飞行请求报头:
OPTIONS /destination/of/post HTTP/1.1
Host: laravel.domain.com
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: https://perl.domain.com
X-FirePHP-Version: 0.0.6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Access-Control-Request-Headers: accept, content-type
Accept: */*
Referer: https://perl.domain.com/original/page.html
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
飞行前响应报头:
HTTP/1.1 200 OK
Date: Mon, 28 Sep 2015 17:24:24 GMT
Server: Apache
X-Powered-By: PHP/5.5.9-1ubuntu4.11
Allow: POST
Cache-Control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://www.readytoship.com.au
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-headers: ACCEPT, CONTENT-TYPE
Set-Cookie: XSRF-TOKEN=eyJpdiI6ImVRTGM3Q1I5RUttXC83NlVLNEN3Z3ZRPT0iLCJ2YWx1ZSI6IlE0SVRjVnJHRHhRUXFYYUhZbVwvSEpLSFp2VVZSa0creW5OUzR2aFdXTEI5VWFEMzBCSkNjeHBzR0dycjVuYWxsOVJ4KzdNVWhhR3dMSmhiam8yUDZcL1E9PSIsIm1hYyI6ImRiYzE4ODRlMTAyOTFkMmY0NTI2YjkzMmExMGZjM2EzOTU2ZDc3N2Q1ZGQzYjNhM2EyNDY5YjhjNGIxMjVlMWYifQ%3D%3D; expires=Mon, 28-Sep-2015 19:24:24 GMT; Max-Age=7200; path=/
Set-Cookie: laravel_session=eyJpdiI6InR5M3JjWkltaVdoSldIa3FsWVp2YUE9PSIsInZhbHVlIjoibjFuODdiVXRKQmdvU1hVcTdcL3VQeWF4K243d2h3Z3EwNWtVeTNWZUdBWGFWQ21QQXlid2RFSmNLSklpanVpZUNhZGE5UlU2Q1FqUCtnSVd4UWkwM2ZRPT0iLCJtYWMiOiI1ZjNjOWQyNmZlNGI1MDI5OGQxOGY2ZGI5M2M1MTMwNWRjZGY4MDVjMGViODNjYjg0MmU5ZWQ0MzRjNjYyN2VhIn0%3D; expires=Mon, 28-Sep-2015 19:24:24 GMT; Max-Age=7200; path=/; httponly
Vary: Accept-Encoding
Content-Encoding: gzip
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa CUSa PSAa IVAa CONo OUR IND UNI STA"
Content-Length: 3501
Keep-Alive: timeout=2, max=80
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST请求头:
POST /destination/of/post HTTP/1.1
Host: laravel.domain.com
Connection: keep-alive
Content-Length: 72
Accept: application/json, text/javascript, */ *; q=0.01
Origin: https://perl.domain.com
X-FirePHP-Version: 0.0.6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Content-Type: application/json
Referer: https://perl.domain.com/original/page.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: _dc_gtm_UA-5119192-1=1; _ga=GA1.3.2141864485.1441288526;
__zlcmid=WXevTAW8aGLGrO;
XSRF-TOKEN=eyJpdiI6ImQ1TFRGaWFwK3cyd3RRa3BzbUNmc0E9PSIsInZhbHVlIjoiNGEydmlLWE96NzZueWtaWWlUa3UzMjZOK29NbmNPb2VidVdVYzdSbkZsaWJMVmxBRitLT05oK3hodUc1ejRMOWJWYzVIeEl6UlpzQ0dIeWlob3pFOFE9PSIsIm1hYyI6IjkzNTczMDJlOWVhZjM5NTU0NGEyNmE5YWNiODcxNDk4YmE0ODEyYTE3ZWExODBiMmNhNDFmMGFhMjVmNjhhYjgifQ%3D%3D;
laravel_session=eyJpdiI6IkIrc3QzUk1iQnNEKysxOEg2UCtSbmc9PSIsInZhbHVlIjoiYXVDalVhaUpDMms3K3AwZFVLV0EyMDMwK25tVUQyYWw5c1MxTVRkZ0ZvVWpcL2lZUndubitsQ2VVMDF1UFcwNzNsR1doNG9TY2diMEhadHdXMEoxamt3PT0iLCJtYWMiOiI5MjE1NWE0MGNmMDgyYzhlYjBjMDUwY2JhOGYxNThjZTM0MjMwM2E3M2VjZjg1ZTgxMzIxZjE5OTkzZDEzZDhhIn0%3D;
_ga=GA1.3.1924987937.1443461035;
_dc_gtm_UA-5119192-1=1;
XSRF-TOKEN=eyJpdiI6ImFiT3ZSWWVDUnlKcWMraGFrWnBVY2c9PSIsInZhbHVlIjoiOTVnc05UM3puVGRwTUNUbDl3T1FNTVpWdGxVM29VaHNLSUt0XC9LTkhzMG5iOGlNbmhHXC9KMDBBTW9qRjZFQXZaSmlHTmhKUVpmTGdpXC80K0lkSUhUdnc9PSIsIm1hYyI6IjI5Njc1ZWE2NTRiYTY4NWJhMmE5Y2UwNjBlZDRkOWE4OGQwOWQ5NjE1YjAyNTMwNTFmZDczY2RjNzRiNjExNDIifQ%3D%3D;
laravel_session=eyJpdiI6IjJqbTRyWG1GOEd1c2NIRnd4eE4yMGc9PSIsInZhbHVlIjoiZzk2SFE2emxcL0xGNjI3aGtYd1NmWURUVEduMVZVY2dYeUlRTVo2UTYyU0I2dFljalhxTjJSY3JFMGpvXC9nc2N0N3dJUFZYbGQya3pUNit1eWtrM3JqZz09IiwibWFjIjoiNDBhYzAzZjkwNDA5ZDE4Y2Y5ZjQ1MjdiYTUwYWU2M2Y5NjVjY2I1ZmMxZWFlMzAwZWM4MmVjNWRlYjM2Yjc2ZSJ9
POST响应头
HTTP/1.0 302 Found
Date: Mon, 28 Sep 2015 17:24:24 GMT
Server: Apache
X-Powered-By: PHP/5.5.9-1ubuntu4.11
Cache-Control: no-cache
Location: https://laravel.domain.com/auth/login
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa CUSa PSAa IVAa CONo OUR IND UNI STA"
Content-Length: 416
Connection: close
Content-Type: text/html
相同名称的两个cookie可能是因为它们在不同的路径中，当您编辑cookie时，您必须指定相同的路径和相同的域，因为您在令牌响应头中获得
额外的cookie (laravel_session和XSRF-TOKEN)没有在/token请求中发送。这表明它们没有/路径。
另外，额外的值不会出现在任何Set-Cookie标头中。
一些可能性/事情需要调查:
- 您的浏览器可能通过直接浏览laravel.domain.com而拾取了cookie。
- cookie是由您没有捕获的请求设置的。
根据我的经验，我可以告诉你，使用Chrome的内置工具并不能告诉你一切。尝试Fiddler(或等效的客户端代理)以确保捕获所有请求和响应。
如果您可以访问两个站点的私钥，您也可以使用WireShark捕获和解密正在交换的原始数据。 - cookies是由之前的会话创建的。
您显示的Set-Cookie头都有expires &Max-Age集。
这意味着它们被保存到Chrome的cookie存储。您可以通过进入Chrome的Settings，单击Show advanced settings，单击Privacy > Content Settings，单击All cookies and site data...来检查存储的cookie。
点击一个域名，它会为每个cookie显示一个"按钮"。点击这些查看path, expires等，可能更重要的是当 cookie被设置