Auth

Get the raw CSRF token for the current browser

Changed on

Fetch with credentials before any other credentialed request at startup and after sign-in or sign-out. Wait for this response before starting other requests. Send the token in the returned header on unsafe requests. With workspace subdomains enabled, a CSRF 403 has problem type urn:hephaestus:csrf. On that response, refetch once and retry the rejected request once.

get/auth/csrf

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /auth/csrf
  • Auth: HTTP bearer

Response

OK

headerNamestring required
tokenstring required

Changes