尝试设置cookie_httponly

public/index.php

@@ -10,6 +10,7 @@ header('Access-Control-Allow-Origin: https://rencai.jiangzi.xin');
 header("Access-Control-Allow-Methods:GET, POST, OPTIONS, DELETE");
 header("Access-Control-Allow-Headers:*");
 define('LARAVEL_START', microtime(true));
+ini_set( 'session.cookie_httponly', 1 );
 
 /*
 |--------------------------------------------------------------------------