Merge branch 'main' into auth-expire-self

flipt-io · Jan 20, 2023 · eb774b9 · eb774b9
2 parents b78d2c0 + 4902107
commit eb774b9
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/internal/cmd/http.go b/internal/cmd/http.go
@@ -129,7 +129,9 @@ func NewHTTPServer(
 		r.Group(func(r chi.Router) {
 			r.Use(func(handler http.Handler) http.Handler {
 				return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-					w.Header().Set("X-CSRF-Token", csrf.Token(r))
+					if cfg.Authentication.Session.CSRF.Key != "" {
+						w.Header().Set("X-CSRF-Token", csrf.Token(r))
+					}
 
 					handler.ServeHTTP(w, r)
 				})