Skip to content

Refactor and checked rest Calls for CSRF support#1687

Merged
johbaxter merged 2 commits intodevfrom
1536-check-rest-calls-for-csrf-support
Aug 13, 2025
Merged

Refactor and checked rest Calls for CSRF support#1687
johbaxter merged 2 commits intodevfrom
1536-check-rest-calls-for-csrf-support

Conversation

@Vishal24-Kanini
Copy link
Copy Markdown
Contributor

Description

This PR addresses CSRF protection support for REST API calls. Every runPixel call is supposed to get attach with CSRF.

Problem

  • I have found that the current interceptor setup in base.ts, both request GET and POST types using the same interceptor logic, even during the CSRF token retrieval process. i am not sure whether this causing the infinite loop or something else because request is hitting the backend but token didn't attach to the further runPixel call.
  • i also found that the in App.tsx and config.store, setGeneneralReactore() will run before ENV.CSRF became true when component mounts in App.tsx and that's why CSRF didn't get attached to it and META|Helpjson() getting failed.
image

Changes Made

  • bypass the interceptor when fetching the CSRF token so it doesn’t trigger itself. Used raw fetch(), not the wrapped get().
  • I have set CSRF flags inside initialize() before setGeneralReactors() in config.store.
  • in this way the csrf is working , CSRF should support every rest call when enabled.
image

@Vishal24-Kanini Vishal24-Kanini self-assigned this Aug 12, 2025
@Vishal24-Kanini Vishal24-Kanini linked an issue Aug 12, 2025 that may be closed by this pull request
1 task
@johbaxter johbaxter marked this pull request as ready for review August 13, 2025 19:19
@johbaxter johbaxter requested a review from a team as a code owner August 13, 2025 19:19
@johbaxter
Copy link
Copy Markdown
Contributor

We will need to refactor some of the logic here.

We make one too many fetchCSRF calls.

We likely need to relocate where we do our interceptor, or it may be that the initial Env.update is not synchronously happening with the runPixels that happen on load.

@johbaxter johbaxter merged commit 5c3bc6b into dev Aug 13, 2025
3 checks passed
@johbaxter johbaxter deleted the 1536-check-rest-calls-for-csrf-support branch August 13, 2025 19:43
@github-actions
Copy link
Copy Markdown

@CodiumAI-Agent /update_changelog

@QodoAI-Agent
Copy link
Copy Markdown

Changelog updates: 🔄

2025-08-13 *

Changed

  • Refactored request handling to properly attach CSRF tokens to REST calls and prevent interceptor recursion.

Fixed

  • Ensured CSRF initialization occurs before setting reactors to avoid missing tokens in subsequent requests.

to commit the new content to the CHANGELOG.md file, please type:
'/update_changelog --pr_update_changelog.push_changelog_changes=true'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Check Rest Calls for CSRF support

3 participants