Bug: Mandatory CSRF header hard to fill in javascript
Description
Hi today, CSRF request client to both send the cookie and a header however I have trouble to send the header since the cookie is a httpOnly one that I can't access in my javascript app. I don't understand why we need both, why is it mandatory, and if it is, how should I process to retrieve the cookie value to feed the header ?
Steps to reproduce
1. Run `document.cookie` when there is a CSRF token in a web browser
2. Find out we can't retrieve it, so we can't feed the CSRF headerLitestar Version
2.12.1
Platform
- Linux
- Mac
- Windows
- Other (Please specify in the description above)
litestar-org / litestar
Production-ready, Light, Flexible and Extensible ASGI API framework | Effortlessly Build Performant APIs
5.5k
How does funding with Polar work?
1
Pay now to fund the work behind this issue.
2
Get updates on progress being made.
3
Maintainer is rewarded once the issue is completed.
FAQ
Backer
You're funding impactful open source efforts
Contributor
You want to contribute to this effort
Maintainer
You want to get funding like this too