Closed lksnmnn closed 3 years ago
Thanks for the report!
For whoever want's investigate, all the relevant code is in this file: https://github.com/blitz-js/blitz/blob/canary/packages/core/src/server/auth/sessions.ts
Hey @mabadir any progress on this? I'd be happy to help looking in to this, if you haven't had time so far.
Hey @lksnmnn. I am planning to look into it today. Go for it if you have the time.
What is the problem?
When updating a user's session data inside of
getServerSideProps
usingsession.$setPublicData
somehow the antiCSRF cookie value is being set to"undefined"
resulting in a CSRF error which can only be resolved by deleting the session cookie and log in again.Reproduction repository: https://github.com/lksnmnn/blitz-gssp-csrf/commit/39ccd2a379eb2893e5362e9e0fb52ecdac421689
Paste all your error logs here:
Paste all relevant code snippets here:
What are detailed steps to reproduce this?
Run
blitz -v
and paste the output here:Please include below any other applicable logs and screenshots that show your problem:
No response