lxe/workflow-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix CSRF token: read from cookie after page reload

Browse Source
This commit is contained in:
Kühn
2026-08-25 12:02:07 +02:00
parent 3e1ac99f38
commit b0fcabe4a5
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
frontend/src/utils/api.js
View File

@@ -8,12 +8,19 @@ export const FILE_BASE = import.meta.env.VITE_API_BASE
// P5: CSRF token kept in memory only (not localStorage - not sensitive, but avoids stale tokens) // P5: CSRF token kept in memory only (not localStorage - not sensitive, but avoids stale tokens)
let csrfToken = null; let csrfToken = null;
// Helper: Read CSRF token from cookie (fallback after page reload)
function getCSRFTokenFromCookie() {
const match = document.cookie.match(/workflow_csrf=([^;]+)/);
return match ? match[1] : null;
}
export function setCSRFToken(token) { export function setCSRFToken(token) {
csrfToken = token; csrfToken = token;
} }
export function getCSRFToken() { export function getCSRFToken() {
return csrfToken; // Return memory token, or fallback to cookie (after page reload)
return csrfToken || getCSRFTokenFromCookie();
} }
// P5: Auth relies on HttpOnly cookie only - no token in localStorage // P5: Auth relies on HttpOnly cookie only - no token in localStorage