ciphera-net/pulse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 15 Wiki Activity

fix: pass CSRF token to switch-context call in refresh route

Browse Source 
The auth API requires CSRF tokens on POST requests. The switch-context
call was failing silently with 403, causing refreshed tokens to lack
org_id.
This commit is contained in:
Usman Baig
2026-03-13 11:29:45 +01:00
parent 34c80d0857
commit 2d3388546f
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
app/api/auth/refresh/route.ts
View File

@@ -42,6 +42,12 @@ export async function POST() {
const data = await res.json() const data = await res.json()
let finalAccessToken = data.access_token let finalAccessToken = data.access_token
// * Get CSRF token from Auth API refresh response (needed for switch-context call)
const csrfToken = res.headers.get('X-CSRF-Token')
// * Also check for CSRF token in the cookie store (browser may have sent it)
const csrfFromCookie = cookieStore.get('csrf_token')?.value
const csrfForRequests = csrfToken || csrfFromCookie || ''
// * Step 2: Restore organization context // * Step 2: Restore organization context
// * The auth service's refresh endpoint returns a "base" token without org_id. // * The auth service's refresh endpoint returns a "base" token without org_id.
// * We need to call switch-context to get an org-scoped token so that // * We need to call switch-context to get an org-scoped token so that
@@ -73,6 +79,8 @@ export async function POST() {
headers: { headers: {
'Content-Type': 'application/json', 'Content-Type': 'application/json',
'Authorization': `Bearer ${finalAccessToken}`, 'Authorization': `Bearer ${finalAccessToken}`,
'X-CSRF-Token': csrfForRequests,
'Cookie': `csrf_token=${csrfForRequests}`,
}, },
body: JSON.stringify({ organization_id: orgId }), body: JSON.stringify({ organization_id: orgId }),
}) })
@@ -83,9 +91,6 @@ export async function POST() {
} catch { /* proceed with base token */ } } catch { /* proceed with base token */ }
} }
// * Get CSRF token from Auth API response header (for cookie rotation)
const csrfToken = res.headers.get('X-CSRF-Token')
cookieStore.set('access_token', finalAccessToken, { cookieStore.set('access_token', finalAccessToken, {
httpOnly: true, httpOnly: true,
secure: process.env.NODE_ENV === 'production', secure: process.env.NODE_ENV === 'production',