FR: Return new CSRF token in response of any controller that consumes CSRF

[timkelty]

Currently, if you have an SPA or even just ajax requests to controllers that require a CSRF, you can pass it along, probably getting it from your template

Great – except now that CSRF has been used, so you need a new one, but if your page hasn't reloaded, you don't have one. Making a subsequent request just to get a CSRF is wasteful, and Craft doesn't really have a controller for that anyway (although you could use users/get-remaining-session-time).

What would be ideal is any controller that consumed a CSRF token, also created a new one and returned it in the json response.

Related: https://craftcms.stackexchange.com/questions/28735/csrf-in-headless-applications from @AugustMiller

[timkelty]

On further examination, it seems this is only really needed for the login/logout controllers, as those generate a new CSRF.

[timkelty]

👏

[narration-sd]

nice job, @timkelty - you can be a pretty handy guy :)

[khalwat]

Thank you @timkelty

[AugustMiller]

Very cool! Updated the Stack Overflow answer to mention this. ❤️