I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft cms plugin - https://github.com/dukt/like

So far the user is able to sign up, login and logout. However I’m having issues with accessing the renewed CSRF token when then the user logs in. I am accessing the CSRF token as per the documentation - https://craftcms.com/support/csrf-protection#updating-your-javascript. So these are currently the steps of the CSRF token login process.

1) User lands on website and the CSRF token is created e.g. pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL

2) User logs in (updated CSRF token is generated, don’t have access to it unless I refresh the page).

3) User likes an entry (400 error ’The CSRF token could not be verified.’).

4) Refresh the page CSRF Token = pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL\x7C42101f4b43f2bc331d376d055c77c8f7146d30e4

5) User can now like an entry.

I’ve tried to get the updated CSRF token from the cookie, but I can’t access it via document.cookie for security because they are tagged httponly.

Is there a way to get the updated value of the CSRF token? Possibly after the login action?

Thanks for any help!

  • 1
    You could perhaps add the CSRF token to your HTTP responses via craft()->request->getCsrfToken()? – Maarten de Graaf Sep 29 '17 at 11:54
  • Did you manage to figure this out? I have the same issue. – Daniel Jan 15 '18 at 9:38
  • OP and @Daniel did either of you work it out? Think I’m running into the same issue. – Josh Angell Jan 19 '18 at 17:00
  • @JoshAngell well basically what I ended up doing was to create a new endpoint in element spi that simply returns a new token after a post request has been made, then store that into my app's state to be used again – Daniel Jan 19 '18 at 21:00
  • @Daniel Yeah I’m trying something similar but still getting the issue ... are you fetching that endpoint with GET or POST? – Josh Angell Jan 19 '18 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.