Skip to content

Send the CSRF token with the AI palette and font requests - #955

Open
jjroelofs wants to merge 2 commits into
8.xfrom
jur/8.x/csrf-token-ai-endpoints
Open

jjroelofs wants to merge 2 commits into
8.xfrom
jur/8.x/csrf-token-ai-endpoints

Conversation

@jjroelofs

Copy link
Copy Markdown
Collaborator

Summary

The admin palette and font generators now fetch a CSRF token from session/token and send it as X-CSRF-Token. This is needed because dxpr_theme_helper now requires that header on generate-palette and generate-fonts.

Merge this PR before dxpr/dxpr_theme_helper#55.

Linked issues

Refs dxpr/dxpr_theme_helper#55

Testing

  • theme-settings-colors.js and theme-settings-fonts.js were edited; the settings admin bundle was rebuilt with npm run build (only the settings admin bundle changed in the diff).
  • Checked on a local DXPR CMS (Drupal 11.4): the endpoints return 403 without the header and accept a valid token. The generator buttons in the browser were not run.

The admin palette and font generators POST to dxpr_theme_helper routes
that now require the X-CSRF-Token header. Fetch the token from
session/token and send it with each request. Rebuilt the settings admin
bundle.

Refs dxpr/dxpr_theme_helper#55
The new token fetch pushed lines past the 80 column limit, so the eslint prettier rule failed in CI. Reformat both files to match prettier. No behaviour change.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant