When logging in via a POST to
I'm sent back a response that looks like this
I'm also sent back a session cookie that looks like this
When I send a GET to
I receive a seperate token that looks like this
I understand that the logout token is used with
/user/logout in order remove the cookie and log the user out.
My questions are as follows.
The Cross Site Request Forgery token doesn't seem to be required by any of my end points by default. Is this something I should have the backend require them on specific paths using
_csrf_token: 'TRUE' (and be passing with each request using the
X-XSRF-TOKEN header?) Is this automatically passed with the cookie by chance?
The same question goes for the session token from
session/token should this be being passed with each request, or in general what is the purpose for this token? I've seen this token referenced in docs as another CSRF token. If this is the case why is it different than the one provided by the login POST?