set csrf cookie name from env var (#1420)

* set csrf cookie name from env var * foken token
mitodl · Aug 15, 2024 · 97f72e0 · 97f72e0
1 parent c143154
commit 97f72e0
Show file tree

Hide file tree

Showing 10 changed files with 15 additions and 2 deletions.
diff --git a/.github/workflows/production.yml b/.github/workflows/production.yml
@@ -45,6 +45,7 @@ jobs:
           POSTHOG_PROJECT_API_KEY: ${{ secrets.POSTHOG_PROJECT_API_KEY_PROD }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN_PROD }}
           SENTRY_ENV: ${{ secrets.MITOPEN_ENV_PROD }}
+          CSRF_COOKIE_NAME: ${{ secrets.CSRF_COOKIE_NAME_PROD }}
           MITOL_AXIOS_WITH_CREDENTIALS: true
           MITOL_API_BASE_URL: https://api.learn.mit.edu
           MITOL_SUPPORT_EMAIL: [email protected]

diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
@@ -45,6 +45,7 @@ jobs:
           POSTHOG_PROJECT_API_KEY: ${{ secrets.POSTHOG_PROJECT_API_KEY_RC }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN_RC }}
           SENTRY_ENV: ${{ secrets.MITOPEN_ENV_RC }}
+          CSRF_COOKIE_NAME: ${{ secrets.CSRF_COOKIE_NAME_RC }}
           MITOL_AXIOS_WITH_CREDENTIALS: true
           MITOL_API_BASE_URL: https://api.rc.learn.mit.edu
           MITOL_SUPPORT_EMAIL: [email protected]

diff --git a/env/shared.env b/env/shared.env
@@ -1,5 +1,6 @@
 MITOL_API_BASE_URL=http://api.open.odl.local:8063
 MITOL_APP_BASE_URL=http://open.odl.local:8062
 MITOL_SUPPORT_EMAIL=support@localhost
+CSRF_COOKIE_NAME=csrftoken-local
 
 POSTHOG_TIMEOUT_MS=1500
diff --git a/frontends/api/jest.config.ts b/frontends/api/jest.config.ts
@@ -11,6 +11,7 @@ const config: Config.InitialOptions = {
     APP_SETTINGS: {
       MITOL_AXIOS_WITH_CREDENTIALS: false,
       MITOL_API_BASE_URL: "https://api.test.learn.mit.edu",
+      CSRF_COOKIE_NAME: "csrftoken-test",
     },
   },
 }

diff --git a/frontends/api/src/axios.ts b/frontends/api/src/axios.ts
@@ -4,7 +4,7 @@ import axios from "axios"
  * Our axios instance with default baseURL, headers, etc.
  */
 const instance = axios.create({
-  xsrfCookieName: "csrftoken",
+  xsrfCookieName: APP_SETTINGS.CSRF_COOKIE_NAME,
   xsrfHeaderName: "X-CSRFToken",
   withXSRFToken: true,
   withCredentials: APP_SETTINGS.MITOL_AXIOS_WITH_CREDENTIALS,

diff --git a/frontends/api/src/types/settings.d.ts b/frontends/api/src/types/settings.d.ts
@@ -4,5 +4,6 @@ export declare global {
   const APP_SETTINGS: {
     MITOL_AXIOS_WITH_CREDENTIALS?: boolean
     MITOL_API_BASE_URL?: string
+    CSRF_COOKIE_NAME: string
   }
 }
diff --git a/frontends/mit-learn/src/services/axios.ts b/frontends/mit-learn/src/services/axios.ts
@@ -5,7 +5,7 @@ import axios from "axios"
  */
 const instance = axios.create({
   baseURL: "/api/v0",
-  xsrfCookieName: "csrftoken",
+  xsrfCookieName: APP_SETTINGS.CSRF_COOKIE_NAME,
   xsrfHeaderName: "X-CSRFToken",
 })
 

diff --git a/frontends/mit-learn/webpack.config.js b/frontends/mit-learn/webpack.config.js
@@ -39,6 +39,7 @@ const {
   EMBEDLY_KEY,
   CKEDITOR_UPLOAD_URL,
   SENTRY_DSN,
+  CSRF_COOKIE_NAME,
 } = cleanEnv(process.env, {
   NODE_ENV: str({
     choices: ["development", "production", "test"],
@@ -97,6 +98,10 @@ const {
     desc: "Sentry Data Source Name",
     default: "",
   }),
+  CSRF_COOKIE_NAME: str({
+    desc: "Name of the CSRF cookie",
+    default: "csrftoken",
+  }),
 })
 
 const MITOL_FEATURES_PREFIX = "FEATURE_"
@@ -221,6 +226,7 @@ module.exports = (env, argv) => {
           SITE_NAME: JSON.stringify(SITE_NAME),
           MITOL_SUPPORT_EMAIL: JSON.stringify(MITOL_SUPPORT_EMAIL),
           PUBLIC_URL: JSON.stringify(PUBLIC_URL),
+          CSRF_COOKIE_NAME: JSON.stringify(CSRF_COOKIE_NAME),
         },
       }),
     ]

diff --git a/frontends/ol-utilities/src/types/settings.d.ts b/frontends/ol-utilities/src/types/settings.d.ts
@@ -10,6 +10,7 @@ export declare global {
   declare const APP_SETTINGS: {
     MITOL_AXIOS_WITH_CREDENTIALS?: boolean
     MITOL_API_BASE_URL: string
+    CSRF_COOKIE_NAME: string
     EMBEDLY_KEY: string
     CKEDITOR_UPLOAD_URL?: string
     SENTRY_DSN?: string

diff --git a/main/settings.py b/main/settings.py
@@ -166,6 +166,7 @@
 
 CSRF_COOKIE_SECURE = get_bool("CSRF_COOKIE_SECURE", True)  # noqa: FBT003
 CSRF_COOKIE_DOMAIN = get_string("CSRF_COOKIE_DOMAIN", None)
+CSRF_COOKIE_NAME = get_string("CSRF_COOKIE_NAME", "csrftoken")
 
 CSRF_HEADER_NAME = get_string("CSRF_HEADER_NAME", "HTTP_X_CSRFTOKEN")