MathewFrancis/cezenGIT
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xsrf cookie for CORS

Browse Source
This commit is contained in:
MathewFrancis 2025-06-10 17:26:59 +05:30
parent c8575e0b11
commit 3799e416e8
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
MySQL_conf_pbx/test1/mariadb_data/ib_logfile0
View File

Binary file not shown.

4
MySQL_conf_pbx/test1/reactcezenpbx/src/http_routs/phone_operations_http.js
View File

@ -10,8 +10,8 @@ export async function createEndpointHttpEeq(inputForm = {}) {
//body: JSON.stringify(inputForm), //body: JSON.stringify(inputForm),
credentials: "include", //This sends cookies (even HTTP-only ones) credentials: "include", //This sends cookies (even HTTP-only ones)
}); });
// const xsrf_json_resp = await xsrf.json(); const xsrf_json_resp = await xsrf.json();
console.log(xsrf); console.log(xsrf_json_resp);
// const response = await fetch(`${socket}/cezen/add_user`, { // const response = await fetch(`${socket}/cezen/add_user`, {
// method: "POST", // method: "POST",

6
MySQL_conf_pbx/test1/springCezenPBX/src/main/java/com/example/cezenPBX/config/CezenLoginSecurityChain.java
View File

@ -37,7 +37,11 @@ public class CezenLoginSecurityChain {
//CSRF cookie //CSRF cookie
final CookieCsrfTokenRepository cookieCsrfTokenRepo = new CookieCsrfTokenRepository(); final CookieCsrfTokenRepository cookieCsrfTokenRepo = new CookieCsrfTokenRepository();
//make secure true when using only https //make secure true when using only https
cookieCsrfTokenRepo.setCookieCustomizer(responseCookieBuilder -> responseCookieBuilder.secure(false)); cookieCsrfTokenRepo.setCookieCustomizer(responseCookieBuilder -> {
responseCookieBuilder.secure(true);
responseCookieBuilder.sameSite("None");
responseCookieBuilder.build();
});
// bellow line is used when you are using JWT tokens instead of jSession session keys but i put always because i guess CSRF token needs it // bellow line is used when you are using JWT tokens instead of jSession session keys but i put always because i guess CSRF token needs it
http. http.