There are a number of answers here about how to send CSRF tokens along with AJAX requests, but I think my question is a little different. Please excuse the abstractness here:
In a headless application, I'd like to be able to log users in via AJAX, and keep a fresh CSRF token in the client-side application's state.
Is there a way to get a new token, once one has been consumed?
Imagine a case where a customer adds an item to their cart—that token is consumed, and a new one is issued on the next page load… but what if there isn't a new page load?
Am I even thinking about this the right way?
In looking at the UsersController
, I noticed that the get-remaining-session-time
action sends a csrfTokenValue
. Any chance this is part of the answer?