4
A similar question was asked in the Craft Slack today, so I thought I'd transcribe the consensus:
Internally, CSRF tokens come from a call to Craft::$app->getRequest()->getCsrfToken(). This means that any controller (or template, for that matter—more often handled by the {{ csrfInput() }} shortcut method) can grab a CSRF token at will.
In the ...
3
Since Craft 3.3.1, you can create a custom alias that resolves to your frontend base URL, and add that alias to the relevant preview targets' "URL Format" setting.
For example, assuming you put something like the below in your config/general.php file:
'aliases' => [
'@previewBaseUrl' => 'https://domain.com',
],
...you'd be able to use that @...
answered Dec 28 '19 at 20:55
Mats Mikkel Rummelhoff
19k3 gold badges27 silver badges59 bronze badges
2
they updated the sourceNodes cycle since this config, you will need to update the schema first doing something like this:
An example using the body hook if you need it:
createSchemaCustomization({ refresh: true }).then(() => {
sourceNodes({ webhookBody });
});
2
with a get request from /index.php?p=admin/actions/users/session-info&dontExtendSession=1 I can get my CSRF Code + the User ID. Great.
2
Got it working like this:
<ng-template ngFor let-obj [ngForOf]="entry.imageHero">
<h1>{{ obj.heroTitle }}</h1>
</ng-template>
This also works:
{{ entry.imageHero[0].heroTitle }}
2
When you enter live preview in the cp, it's an iframe to the URL you've set up for that section, including a token=xxxxxxxx, you need to pass this along to your GraphQL (assuming that's what you use), to let it know it's not supposed to fetch data from the database.
Andrew Welch has a bit more info about it here: https://nystudio107.com/blog/headless-...
2
You could make the CSRF token available via an element API endpoint, then submit the form with that;
'api/csrf-token' => [
'elementType' => GlobalSet::class,
'paginate' => false,
'one' => true,
'transformer' => function () {
$newCSRFtoken = Craft::$app->request->getCsrfToken(); // sets a new CSRF cookie;
...
2
After looking at the Commerce docs further, I see I can use the GraphQL API to get information from Commerce. That is, at least for products. Craft 3.5 will allow GraphQL mutations so perhaps that’ll encompass some sort of write API to commerce. If not, I’ll have to create custom endpoints in the Craft app to do the following:
Create customer account
Edit ...
2
RAND() is the correct way to do this. (At least, it works in 3.5). One catch is that GraphQL queries are cached by default, so your results will always be returned in the same random order until your cache is invalidated. If you're using Nuxt with a static target, your entries will be displayed in the same order until the cache is expired and your app is ...
1
You can use defaultCookieDomain config setting to make all Craft cookies use your root domain:
// config/general.php
// mind the dot at the start
'defaultCookieDomain' => '.mydomain.com',
This ensures that Craft's cookies apply to both the root domain and the subdomain, so the login should persist.
1
Sounds like a custom plugin or module would work for you here, allowing you to hook into the entry after save event.
use craft\elements\Entry;
use craft\events\ModelEvent;
use yii\base\Event;
Event::on(
Entry::class,
Entry::EVENT_AFTER_SAVE,
function(ModelEvent $event) {
$entry = $event->sender;
if (!$entry->getIsDraft()) {...
1
I don't have a good answer for this, but my response is too long to to put into a comment so here goes. I've been experiencing the same thing — I can successfully retrieve the CSRF token, but when I try to log in I get the dreaded 400 Bad Request error.
I found this tidbit on a page about Yii CSRF protection:
When you ebable CSRF validation and use form ...
1
Apparently, the answers are the following:
Redactor doesn't know how to output slugs/URIs instead of full URLs
Possibly a solution comes up with craft in the future
My API setup is suboptimal: In fact, I did set the baseUrl including the language: https://frontend.com/de. The recommendation is to not do that at the moment but keep one "Site" for all ...
1
Check out the Imager Pre-transform plugin, or I can recommend a service like https://www.imgix.com where you can perform transforms using url parameters.
1
Absolutely! Craft works really well like this. You can use twig to render your website, then either element api or graph QL (built in to craft 3.3) to open up your data to other applications.
I run several sites like this where I’ve opened up various parts of the content for external use, e.g. the news feed for use in an app.
1
Take a look at the craft documentation for this: https://craftcms.com/guides/enabling-csrf-protection#updating-your-javascript it should point you in the right direction.
Only top voted, non community-wiki answers of a minimum length are eligible