When logging in via a POST to user/login?_format=json
I'm sent back a response that looks like this
{
"current_user": {
"uid": "233",
"name": "test"
},
"csrf_token": "XXXXXR5HQwidW7CKIDL52tOg4JGKi7Pa-j87KKlr8Mg",
"logout_token": "XXXX-G35feFznaapSggzlUQEhYKXqom6yYVDwCH5Zxc"
}
I'm also sent back a session cookie that looks like this
name: SESS95f37088bf4f23c4304d24270b7xxxxx
value: rqAupOwS2ieqwClBkwEaWj8-ywLqnQEcAL2xOG-xxxx
When I send a GET to session/token
I receive a seperate token that looks like this _XXXXXnX8k_prCNfdrHp6XeHOUx7DcuouqiLKBBn-Go
I understand that the logout token is used with /user/logout
in order remove the cookie and log the user out.
My questions are as follows.
The Cross Site Request Forgery token doesn't seem to be required by any of my end points by default. Is this something I should have the backend require them on specific paths using _csrf_token: 'TRUE'
(and be passing with each request using the X-XSRF-TOKEN
header?) Is this automatically passed with the cookie by chance?
The same question goes for the session token from session/token
should this be being passed with each request, or in general what is the purpose for this token? I've seen this token referenced in docs as another CSRF token. If this is the case why is it different than the one provided by the login POST?