Can not use Laravel Livewire / Missing custom "X-" headers in Bref

[buddhaCode]

Hi folks,
I try to use some Laravel Livewire components and I am using Bref to run my app with AWS Lambda. I seems not to work out of the box and I could need some help to get it running. Is someone out there, who is using both in combination?

The initial view of my Livewire component is rendered correctly. When I try to change a control in my component, it should re-render, but I get a "Page Expired Dialog" like one can see the in the docs.

I tried several things so narrow it down:

1. I tried to load the JavaScript assets via a dynamic route and via a static load from Cloudfront distribution. I though, there's maybe something out of sync with the JS/PHP parts of Livewire. That was not the problem.
2. First, I was not using a proper cache configuration. I tried using DynamoDB for storing the cache. Maybe Livewire needs a working cache. From as far I can tell from scanning over the source code, it does not. And so, using a proper cache didn't solve the problem.
   TL;DR
3. I found out, that the underlying AJAX request to re-render the DOM returns a HTTP 519 status code. Livewire itself raises a 519 error, when the page is expired. See bullet 1. But I found out, that the specific line in the code is not even called. The 519 error comes from the CSRF token check from Laravel itself. The AJAX request has a request header "X-CSRF-TOKEN" (and another "X-LIVEWIRE" header). Both headers do not make it into the application context. Laravel can not find the CSRF token in the header and thus, it will raise the 519. When I dump getallheaders(), both are simple missing. I tried to exclude the Livewire routes from CSRF-checking. But then, I am getting another exception which is specific to the way Livewire does some security checks. Maybe this is related to the missing CSRF header, too. But I am not sure. I did not dive deep into that section of Livewire.

So, TL;DR, my final question ... are any custom "X-" headers missing in the Bref context? Is it a problem of Bref? Or maybe the API Gateway? I have something on my mind with API Gateway and custom headers. But I am not sure anymore and can not make up my mind.

Best,
Arne

[mnapoli]

Hey, just in case you are using Lift should you whitelist your headers here: https://github.com/getlift/lift/blob/master/docs/server-side-website.md#forwarded-headers ?

[buddhaCode]

Dear Matthieu,
thank you so much. That's it. Yes, I am using Lift. Adding the header worked. Now the CSRF header arrives. That's one step closer to the solution. Now I am getting the same error as with skipping the CSRF check. But I guess that's now a very Livewire specific problem.
I am now getting:

Livewire encountered corrupt data when trying to hydrate the [xxx] component. 
Ensure that the [name, id, data] of the Livewire component wasn't tampered with between requests.

[buddhaCode]

I just added the second header. And now it works :)
For other help seeking people. You need to add these two headers:

- X-Csrf-Token
- X-Livewire

@mnapoli Any Idea how und where to document this issues?

[mnapoli]

@buddhaCode on this page would be great: https://bref.sh/docs/frameworks/laravel.html

At the end you could maybe add a section about Livewire?

[buddhaCode]

Sorry for the delay. Here's my PR #1224