From 98bfc7f5f507b2717d12552f0cfc7120dae2d066 Mon Sep 17 00:00:00 2001 From: Namkhai B Date: Sat, 12 Jun 2021 18:54:19 -0500 Subject: [PATCH] Don't set X-XSRF-TOKEN when the user isn't logged in An HTTP header cannot be empty, and although some webservers allow this (nginx, Apache), others answer 400 Bad Request (lighttpd), preventing the widget from loading. --- frontend/app/common/fetcher.test.ts | 4 ++-- frontend/app/common/fetcher.ts | 8 +++++++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/frontend/app/common/fetcher.test.ts b/frontend/app/common/fetcher.test.ts index 3035837e..bab8d02b 100644 --- a/frontend/app/common/fetcher.test.ts +++ b/frontend/app/common/fetcher.test.ts @@ -4,7 +4,7 @@ jest.mock('./settings', () => ({ import { RequestError } from 'utils/errorUtils'; import { API_BASE, BASE_URL } from './constants.config'; -import { apiFetcher, authFetcher, adminFetcher, JWT_HEADER, XSRF_HEADER } from './fetcher'; +import { apiFetcher, authFetcher, adminFetcher, JWT_HEADER } from './fetcher'; type FetchImplementaitonProps = { status?: number; @@ -31,7 +31,7 @@ function mockFetch({ headers = {}, data = {}, ...props }: FetchImplementaitonPro } describe('fetcher', () => { - const headers = { [XSRF_HEADER]: '' }; + const headers = {}; const apiUri = '/anything'; const apiUrl = `${BASE_URL}${API_BASE}/anything?site=remark`; diff --git a/frontend/app/common/fetcher.ts b/frontend/app/common/fetcher.ts index 1689d484..df19d420 100644 --- a/frontend/app/common/fetcher.ts +++ b/frontend/app/common/fetcher.ts @@ -45,7 +45,13 @@ const createFetcher = (baseUrl: string = ''): Methods => { if (activeJwtToken) { headers[JWT_HEADER] = activeJwtToken; } - headers[XSRF_HEADER] = getCookie(XSRF_COOKIE) || ''; + + // An HTTP header cannot be empty. + // Although some webservers allow this (nginx, Apache), others answer 400 Bad Request (lighttpd). + const xsrfToken = getCookie(XSRF_COOKIE); + if (xsrfToken !== undefined) { + headers[XSRF_HEADER] = xsrfToken; + } if (body instanceof FormData) { // Shouldn't add any kind of `Content-Type` if we send `FormData`