mirrors/axios
2
0
Fork 0
mirror of https://github.com/tenrok/axios.git synced 2026-06-11 18:02:32 +03:00
Code Activity

feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#6046)

Browse Source
This commit is contained in:
Dmitriy Mozgovoy
2023-11-14 15:38:25 +02:00
committed by GitHub
parent 7009715369
commit cff996779b
8 changed files with 110 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/adapters/xhr.js
+10 -7
View File
@@ -49,7 +49,7 @@ export default isXHRAdapterSupported && function (config) {
return new Promise(function dispatchXhrRequest(resolve, reject) {
let requestData = config.data;
const requestHeaders = AxiosHeaders.from(config.headers).normalize();
const responseType = config.responseType;
let {responseType, withXSRFToken} = config;
let onCanceled;
function done() {
if (config.cancelToken) {
@@ -185,13 +185,16 @@ export default isXHRAdapterSupported && function (config) {
// Add xsrf header
// This is only done if running in a standard browser environment.
// Specifically not if we're in a web worker, or react-native.
if (platform.hasStandardBrowserEnv) {
// Add xsrf header
// regarding CVE-2023-45857 config.withCredentials condition was removed temporarily
const xsrfValue = isURLSameOrigin(fullPath) && config.xsrfCookieName && cookies.read(config.xsrfCookieName);
if(platform.hasStandardBrowserEnv) {
withXSRFToken && utils.isFunction(withXSRFToken) && (withXSRFToken = withXSRFToken(config));
if (xsrfValue) {
requestHeaders.set(config.xsrfHeaderName, xsrfValue);
if (withXSRFToken || (withXSRFToken !== false && isURLSameOrigin(fullPath))) {
// Add xsrf header
const xsrfValue = config.xsrfHeaderName && config.xsrfCookieName && cookies.read(config.xsrfCookieName);
if (xsrfValue) {
requestHeaders.set(config.xsrfHeaderName, xsrfValue);
}
}
}