[question] How do I set csrf token from React

[daisuke0925m]

I'm writing a go and react application.

I am trying to use gorilla / csrf as a CSRF countermeasure for SPA.

go and react are developed in completely independent domains.

go port8080 react port3000

I wrote the following code to set the csrf token.

// Route return API routing
func Route(app *App) *mux.Router {
	r := mux.NewRouter()

	api := r.PathPrefix("/api").Subrouter()

	csrfMiddleware := csrf.Protect([]byte("32-byte-long-auth-key"), csrf.Secure(false), csrf.TrustedOrigins([]string{os.Getenv("CORS_URL")}))

	api.Use(app.preflitMiddleWare)
	api.Use(csrfMiddleware)

	// user
	api.HandleFunc("/users/{id:[0-9]+}", app.tokenVerifyMiddleWare(app.userGetHandler)).Methods("GET", "OPTIONS")
	api.HandleFunc("/users", app.signupHandler).Methods("POST", "OPTIONS")
	api.HandleFunc("/users/{id:[0-9]+}", app.userDeleteHandler).Methods("DELETE", "OPTIONS")
	api.HandleFunc("/users/{id:[0-9]+}", app.userUpdateHandler).Methods("PUT", "OPTIONS")
	// like
	api.HandleFunc("/users/{id:[0-9]+}/likes", app.tokenVerifyMiddleWare(app.likeGetALLHandler)).Methods("GET", "OPTIONS")
	api.HandleFunc("/users/{id:[0-9]+}/likes", app.tokenVerifyMiddleWare(app.likePostHandler)).Methods("POST", "OPTIONS")
	api.HandleFunc("/users/{id:[0-9]+}/likes/{id:[0-9]+}", app.tokenVerifyMiddleWare(app.likeDeleteHandler)).Methods("DELETE", "OPTIONS")
	// auth
	api.HandleFunc("/login", app.loginHandler).Methods("POST", "OPTIONS")
	api.HandleFunc("/logout", app.tokenVerifyMiddleWare(app.logoutHandler)).Methods("POST", "OPTIONS")
	api.HandleFunc("/refresh_token", app.refreshTokenHandler).Methods("POST", "OPTIONS")
	// fgi
	api.HandleFunc("/fgi", app.fgiHandler).Methods("GET", "OPTIONS")
	// ticker
	api.HandleFunc("/ticker", app.tickerHandler).Methods("GET", "OPTIONS")
	return r
}

Route is called below.

func run() error {
	app := controllers.NewApp(models)
	r := controllers.Route(app)

	http.Handle("/", r)
	return http.ListenAndServe(fmt.Sprintf(":%d", 8080), nil)
}

func main() {
	if err := run(); err != nil {
		log.Fatal(err)
	}
}

and set Header

	w.Header().Set("X-CSRF-Token", csrf.Token(r))

This is browser

How should I set tokens on React side?

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.