Send XSRF-TOKEN cookie as x-csrf-token header in api() and adminApi() for mutating requests

Author: ddrayko

public/js/admin.js

@@ -158,6 +158,11 @@ async function adminApi(path, options = {}) {
   if (adminState.token) {
     headers['Authorization'] = `Bearer ${adminState.token}`;
   }
+  const method = (options.method || 'GET').toUpperCase();
+  if (method !== 'GET' && method !== 'HEAD') {
+    const match = document.cookie.match(/(?:^|;\s*)XSRF-TOKEN=([^;]*)/);
+    if (match) headers['x-csrf-token'] = match[1];
+  }
   let res;
   try {
     res = await fetch(`/api/admin${path}`, { ...options, headers });

public/js/app.js

@@ -258,6 +258,11 @@ async function api(path, options = {}) {
   if (state.token) {
     headers['Authorization'] = `Bearer ${state.token}`;
   }
+  const method = (options.method || 'GET').toUpperCase();
+  if (method !== 'GET' && method !== 'HEAD') {
+    const match = document.cookie.match(/(?:^|;\s*)XSRF-TOKEN=([^;]*)/);
+    if (match) headers['x-csrf-token'] = match[1];
+  }
   let res;
   try {
     res = await fetch(`${API_BASE}/api${path}`, { ...options, headers });