various fixes for checkout

resources/js/pages/auth/LoginForm.tsx

@@ -32,7 +32,17 @@ type SharedPageProps = {
 
 type FieldErrors = Record<string, string>;
 
-const csrfToken = () => (document.querySelector('meta[name="csrf-token"]') as HTMLMetaElement | null)?.content ?? "";
+const metaCsrfToken = () =>
+  (document.querySelector('meta[name="csrf-token"]') as HTMLMetaElement | null)?.content ?? "";
+
+const xsrfCookieToken = () => {
+  if (typeof document === "undefined") {
+    return "";
+  }
+
+  const match = document.cookie.match(/(?:^|; )XSRF-TOKEN=([^;]*)/);
+  return match ? decodeURIComponent(match[1]) : "";
+};
 
 export default function LoginForm({ onSuccess, canResetPassword = true, locale, packageId }: LoginFormProps) {
   const page = usePage<SharedPageProps>();
@@ -91,12 +101,19 @@ export default function LoginForm({ onSuccess, canResetPassword = true, locale,
     setIsSubmitting(true);
 
     try {
+      const cookieToken = xsrfCookieToken();
+      const metaToken = metaCsrfToken();
+
       const response = await fetch(loginEndpoint, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
           Accept: "application/json",
-          "X-CSRF-TOKEN": csrfToken(),
+          ...(cookieToken
+            ? { "X-XSRF-TOKEN": cookieToken }
+            : metaToken
+              ? { "X-CSRF-TOKEN": metaToken }
+              : {}),
         },
         credentials: "same-origin",
         body: JSON.stringify({