mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-18 01:25:09 +00:00
ignacionelson
6e47d76ba6
Client file sharing, rebuilt from the ground up: a private area per client, resumable uploads, folders, groups and categories, sharing with expiry dates and download limits, comments, file versions, an activity log, a REST API, and sixteen languages. This repository begins here. ProjectSend 2 was developed privately, and that development history is not published — the previous generation remains available, with its own history, at projectsend/legacy. Free software under the GNU General Public License v2, or (at your option) any later version.
27 lines
1.2 KiB
TypeScript
27 lines
1.2 KiB
TypeScript
/**
|
|
* This installation's CSRF token, read from its cookie.
|
|
*
|
|
* The cookie is named after the installation rather than after the
|
|
* framework (see App\Http\Middleware\ValidateCsrfToken): cookies are
|
|
* scoped by host and ignore the port, so a second Laravel app on the same
|
|
* hostname would otherwise overwrite a shared `XSRF-TOKEN` and every write
|
|
* here would fail with a 419 that looks exactly like an expired session.
|
|
*
|
|
* The name comes from a meta tag because nothing on the client could
|
|
* derive it. `XSRF-TOKEN` remains the fallback so a page rendered by
|
|
* something that does not emit the tag still works.
|
|
*
|
|
* Read fresh on every call, never captured: the value rotates, and a copy
|
|
* taken when a component mounted is a 419 waiting for a long-open tab.
|
|
*/
|
|
export function xsrfCookieName(): string {
|
|
return document.querySelector('meta[name="xsrf-cookie"]')?.getAttribute('content') || 'XSRF-TOKEN';
|
|
}
|
|
|
|
export function xsrfToken(): string {
|
|
const name = xsrfCookieName().replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
const match = document.cookie.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
|
|
|
|
return match ? decodeURIComponent(match[1]) : '';
|
|
}
|