Bradley Nelson
20 lines
782 B
TypeScript
20 lines
782 B
TypeScript
/**
|
|
* CSRF double-submit cookie utility — ported from static/js/core/csrf.js.
|
|
*
|
|
* Reads the `oxicloud_csrf` cookie (NOT HttpOnly) and exposes its value as the
|
|
* `X-CSRF-Token` header. The server's `csrf_middleware` validates that the
|
|
* header matches the cookie for every mutating (POST/PUT/DELETE/PATCH) request
|
|
* authenticated via the HttpOnly session cookie.
|
|
*/
|
|
|
|
export function getCsrfToken(): string {
|
|
const match = document.cookie.split('; ').find((row) => row.startsWith('oxicloud_csrf='));
|
|
return match ? (match.split('=')[1] ?? '') : '';
|
|
}
|
|
|
|
/** Headers to merge into a mutating request; empty when no token is present. */
|
|
export function getCsrfHeaders(): Record<string, string> {
|
|
const token = getCsrfToken();
|
|
return token ? { 'X-CSRF-Token': token } : {};
|
|
}
|