The problem
An Inertia application (which I will refer to as App #2) running on a subdomain (two.example.org.ng
) was returning a 419 Page Expired Error for no reason (or so I thought) if a different application (which I will refer to as App #1) running on a different subdomain (one.example.org.ng
) is launched on the same browser.
It was apparently a session issue and after several hours of frustration it turns out that the issue was caused by conflicting XSRF-TOKEN tokens.
The solution
The cause was actually trivial and the solution was in the .env file.
.env file of App #1
SESSION_DOMAIN=.example.org.ng
.env file of App #2
SESSION_DOMAIN=.two.example.org.ng
Setting SESSION_DOMAIN=.example.org.ng
in App #1 caused the session cookie domain to be set to the parent domain for App #1. The same cookie was also available for App #2 because two.example.org.ng
because lives on the same parent domain as one.example.org.ng
and caused the issue.
Strictly scoping the session domain for App #1 to the subdomain on which it lives solved the problem.
.env file of App #1 (solution)
SESSION_DOMAIN=.one.example.org.ng