New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Question #5

Closed

pavankris opened this issue Oct 13, 2022 · 1 comment

pavankris commented Oct 13, 2022

Should the backend have Get /token endpoint. Isn't that against the csrf not have a endpoint for grabbing the token.

If not how does the frontend get the token, the secret is correctly set in cookies.

Owner

huy97 commented Oct 14, 2022

Nestjs csrf use secret and token to verify request
secret use httpOnly and secure cookie, so javascript client can't manage token in cookies

huy97 closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment