codeforlife 2.6.5 → 2.6.6

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [2.6.6](https://github.com/ocadotechnology/codeforlife-package-javascript/compare/v2.6.5...v2.6.6) (2025-01-27)
+
+
+### Bug Fixes
+
+* csrf header for non-safe http methods ([#75](https://github.com/ocadotechnology/codeforlife-package-javascript/issues/75)) ([d0b2b78](https://github.com/ocadotechnology/codeforlife-package-javascript/commit/d0b2b7852fbdc9f84ade5ec4d46cc8a980e60f1e))
+
 ## [2.6.5](https://github.com/ocadotechnology/codeforlife-package-javascript/compare/v2.6.4...v2.6.5) (2025-01-17)
 
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "codeforlife",
   "description": "Common frontend code",
   "private": false,
-  "version": "2.6.5",
+  "version": "2.6.6",
   "type": "module",
   "scripts": {
     "dev": "vite",

package/src/api/createApi.ts

@@ -1,12 +1,14 @@
 import {
   createApi as _createApi,
   fetchBaseQuery,
+  type FetchArgs,
 } from "@reduxjs/toolkit/query/react"
 
 import { SERVICE_API_URL } from "../settings"
 import defaultTagTypes from "./tagTypes"
 import { buildLogoutEndpoint } from "./endpoints/session"
 import { getCsrfCookie } from "../utils/auth"
+import { isSafeHttpMethod } from "../utils/api"
 
 // TODO: decide if we want to keep any of this.
 // export function handleResponseError(error: FetchBaseQueryError): void {
@@ -36,8 +38,13 @@ export default function createApi<TagTypes extends string = never>({
   const fetch = fetchBaseQuery({
     baseUrl: `${SERVICE_API_URL}/`,
     credentials: "include",
-    prepareHeaders: (headers, { type }) => {
-      if (type === "mutation") {
+    prepareHeaders: (headers, endpoint) => {
+      const { type, arg } = endpoint as typeof endpoint & {
+        arg: string | FetchArgs
+      }
+      const method = typeof arg === "string" ? "GET" : arg.method || "GET"
+
+      if (type === "mutation" || !isSafeHttpMethod(method)) {
         let csrfToken = getCsrfCookie()
         if (csrfToken) headers.set("x-csrftoken", csrfToken)
       }

package/src/utils/api.tsx

@@ -325,3 +325,8 @@ export function handleResultState<QueryArg, ResultType>(
   // Have yet to call the API.
   return loadingNode
 }
+
+export function isSafeHttpMethod(method: string) {
+  // https://datatracker.ietf.org/doc/html/rfc9110.html#section-9.2.1
+  return ["GET", "HEAD", "OPTIONS", "TRACE"].includes(method.toUpperCase())
+}