Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update app.blade.php #125

Merged
merged 1 commit into from
Feb 8, 2022
Merged

Update app.blade.php #125

merged 1 commit into from
Feb 8, 2022

Conversation

iosiflivadaru
Copy link
Contributor

The meta tag approach for csrf tokens won't work in SPA apps, only in blade apps. Removing it fixed the issue I had with uploading files after I login!

The meta tag approach for csrf tokens won't work in SPA apps, only in blade apps. Removing it fixed the issue I had with uploading files after I login!
@taylorotwell
Copy link
Member

Hmm - how was it breaking your application?

@iosiflivadaru
Copy link
Contributor Author

I was using this config for the axios from some other apps I built. When I looked on the app.blade.php I saw that the csrf token was being set so I thought I had to do the same thing, use this config. If I don't use the config below and do a normal axios call it works just fine (noticed that after the pull request). That line of code misled me, sorry for bothering (still new to the VILT stack).

const config = {
  headers: {
    "Content-Type": "multipart/form-data",
    "X-CSRF-TOKEN": document.querySelector('meta[name="csrf-token"]')
      .content,
  },
};

@RobertBoes
Copy link

RobertBoes commented Feb 7, 2022

Actually, I think this line can safely be removed. Inertia / Axios uses the X_XSRF_TOKEN cookie by default, Breeze doesn't include any code to use the meta tag (as far as I can tell). This is also the proper way to use the csrf token, because the cookie will be updated on every request, the meta tag won't be updated.
You'll also run into issues when trying to use the token from the meta tag, like mentioned above, since that token won't be valid

@taylorotwell
Copy link
Member

I dunno - I'm not removing this without more thorough information as to what it is breaking I don't think. I haven't had any other complaints about this breaking stuff since releasing Breeze.

@RobertBoes
Copy link

I dunno - I'm not removing this without more thorough information as to what it is breaking I don't think. I haven't had any other complaints about this breaking stuff since releasing Breeze.

It "works" because the token is not being used, problems arise when you do use the meta token, because it's an old token which isn't valid. This tag won't update between requests, so if you'd use this value you'd be sending an old token, causing an CSRF mismatch. Axios uses the cookie value (https://github.com/axios/axios/blob/73e3bdb8835ba942096b662e9441f1d85ce4d484/lib/defaults.js#L117-L118), and not the token defined in the meta tag.

I believe the same reasoning was used to remove the tag from Jetstream laravel/jetstream#878

@driesvints driesvints reopened this Feb 8, 2022
@driesvints
Copy link
Member

@taylorotwell seems we indeed did the same for Jetstream?

@taylorotwell taylorotwell merged commit 82e3a88 into laravel:1.x Feb 8, 2022
@iosiflivadaru iosiflivadaru deleted the patch-1 branch November 23, 2022 15:50
slimani-dev pushed a commit to slimani-dev/breeze that referenced this pull request Jan 21, 2023
The meta tag approach for csrf tokens won't work in SPA apps, only in blade apps. Removing it fixed the issue I had with uploading files after I login!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants