Oxicloud/static/js/core/csrf.js

/**
 * CSRF double-submit cookie utility.
 *
 * Reads the `oxicloud_csrf` cookie (which is NOT HttpOnly) and provides
 * its value as the `X-CSRF-Token` header on mutating requests.
 *
 * Usage:
 *   // In any fetch call that changes state:
 *   fetch(url, { method: 'POST', headers: { ...getCsrfHeaders(), 'Content-Type': 'application/json' } })
 *
 * The server-side `csrf_middleware` validates that the header value matches
 * the cookie for every POST/PUT/DELETE/PATCH request authenticated via
 * HttpOnly cookies.
 */

function getCsrfToken() {
    const match = document.cookie.split('; ').find((row) => row.startsWith('oxicloud_csrf='));
    return match ? match.split('=')[1] : '';
}

/**
 * returns headers to add, this includes the X-CSRF-Token
 * @returns {Record<String, String>}
 */
function getCsrfHeaders() {
    const token = getCsrfToken();
    return token ? { 'X-CSRF-Token': token } : {};
}

export { getCsrfHeaders, getCsrfToken };