From b0fcabe4a5b4460b54db05e3770523fbcc102158 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=BChn?= Date: Tue, 25 Aug 2026 12:02:07 +0200 Subject: [PATCH] Fix CSRF token: read from cookie after page reload --- frontend/src/utils/api.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/frontend/src/utils/api.js b/frontend/src/utils/api.js index 9e745df..0f6371e 100644 --- a/frontend/src/utils/api.js +++ b/frontend/src/utils/api.js @@ -8,12 +8,19 @@ export const FILE_BASE = import.meta.env.VITE_API_BASE // P5: CSRF token kept in memory only (not localStorage - not sensitive, but avoids stale tokens) let csrfToken = null; +// Helper: Read CSRF token from cookie (fallback after page reload) +function getCSRFTokenFromCookie() { + const match = document.cookie.match(/workflow_csrf=([^;]+)/); + return match ? match[1] : null; +} + export function setCSRFToken(token) { csrfToken = token; } export function getCSRFToken() { - return csrfToken; + // Return memory token, or fallback to cookie (after page reload) + return csrfToken || getCSRFTokenFromCookie(); } // P5: Auth relies on HttpOnly cookie only - no token in localStorage