Morgbn / nuxt-csurf

Nuxt Cross-Site Request Forgery (CSRF) Prevention
https://nuxt-csurf.vercel.app
MIT License
81 stars 16 forks source link

CSRF token mismatch on redirect from an API endpoint #10

Closed oyedejioyewole closed 1 year ago

oyedejioyewole commented 1 year ago

In my use case, once a user authorizes my Discord application, the redirect URL (my callback endpoint) redirects, to a /account page

But every time upon the redirect the value of csrf in const { csrf } = useCsrf() changes (that's what I think keeps causing the CSRF token mismatch)

Morgbn commented 1 year ago

The token can change many times, but as long as the secret (stored in a cookie) remains the same, it shouldn't rise "CSRF Token Mismatch", because it's the server key and the secret that allow you to check the validity of the token(s). If the problem persists, please create a minimal reproduction, it will be easier to help