-
Notifications
You must be signed in to change notification settings - Fork 64
Closed
vaadin/flow
#21939Labels
Impact: HighSeverity: MajorbugSomething isn't workingSomething isn't workinghillaIssues related to HillaIssues related to Hilla
Description
Describe the bug
Based on the reports in the forum post about abnormal behavior of CSRF token handing in applications with stateless security, it seems that the changes for sharing the CSRF token with Service Worker introduced a bug that results in getting 401 for subsequent requests after a successful login.
Disabling the CSRF (which makes the application work) is not an option in production since it makes the application vulnerable.
Expected-behavior
As by default the JWT token is set in cookies, the application should work with CSRF enabled.
Reproduction
Needs reproduction.
System Info
V24.8
sagarb-git
Metadata
Metadata
Assignees
Labels
Impact: HighSeverity: MajorbugSomething isn't workingSomething isn't workinghillaIssues related to HillaIssues related to Hilla