0

My system composes of NuxtJs and AdonisJs application. Adonis handles csrf tokens for us by sending:

set-cookie: adonis-session=XXX; Path=/; HttpOnly
set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; SameSite=Strict
set-cookie: adonis-session-values=XXX; Path=/; HttpOnly

Now from what I can see, it will set a cookie that can be sent only by a browser. And only if the host is the same. From my understanding, from that point on, browser is the one who will auto attach cookies like that to each request. The problem is, when Nuxt application is making an API request to the back-end I do not see any csrf token being sent when looking at the traffic trough BurpSuite.

And naturally adonis will reply with "Invalid CSRF Token", and respond with status code 500.

I'm not sure what am I missing, I fail to understand why browser is not sending that cookie. And just as the extra information I've failed to find it trough browser's inspector window (Storage tab). Is it possible that the cookie is not set or?

I've seen other posts regarding this issue, but they where not helpful because the solution was composed of reading a cookie and manually sending it as the header. Which I do not advise, and is not the model I'm going to implement. I would rather leave it to the back-end framework and browser to do the job for me, because as we all know, there would be less room for me to make a mistake.

Thank you for reading this.

EDIT; I've confirmed that the Set-Cookie is ignored across browsers. There is no cookie present after receiving a response that states 'Set-Cookie: X'. I've double checked the list of all cookies present within a browser, there is no anti-csrf token present.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.