turns-00082.parquet:12485
7ba1ccfb72eaaed73d686ae9degenerate_repetitionAbsentFinal dense release
USER
2025-05-23 18:51:19 [::1][-][-][trace][app\controllers\ApiSecurityController::actionCsrfToken] CSRF Token from getCsrfToken(): RpddH38dvW6myQxuKQHP18KW1nadtYYhQLClywmDdIQF7nBIJ1ftA8zxRV1bOLWzrKKDF9X0y1Jz9_yAOOwlvA==
2025-05-23 18:51:19 [::1][-][-][info][app\controllers\ApiSecurityController::actionCsrfToken] CSRF token to send to client: RpddH38dvW6myQxuKQHP18KW1nadtYYhQLClywmDdIQF7nBIJ1ftA8zxRV1bOLWzrKKDF9X0y1Jz9_yAOOwlvA==
2025-05-23 18:51:19 [::1][-][-][info][app\controllers\ApiSecurityController::actionCsrfToken] Sending CSRF cookie with params: []
public function actionCsrfToken(): array
{
$request = \Yii::$app->request;
if (!$request->isGet)
{
throw new BadRequestHttpException('Only GET requests are allowed.');
}
$token = $request->getCsrfToken();
\Yii::debug('CSRF Token from getCsrfToken(): ' . $token, __METHOD__);
/**
* Explicitly add CSRF cookie to response (forces Set-Cookie header)
* Note: No need to set cookie manually here
*/
$response = \Yii::$app->response;
/*$response->cookies->add(
new Cookie([
'name' => $request->csrfParam,
'value' => $token,
'httpOnly' => false,// Always false for csrf token
'secure' => YII_ENV_PROD ? true : false,// True if you use HTTPS in production
'sameSite' => YII_ENV_PROD ? Cookie::SAME_SITE_NONE : Cookie::SAME_SITE_LAX,
'path' => '/',// Ensure cookie always overrides previous cookies on all paths
])
);//*/
/**
* Cookie check
*
foreach ($response->cookies as $cookie)
{
\Yii::info("Set-Cookie: {$cookie->name} = {$cookie->value}", __METHOD__);
}//*/
\Yii::info("CSRF token to send to client: $token", __METHOD__);
\Yii::info('Sending CSRF cookie with params: ' . json_encode($response->cookies->toArray()), __METHOD__);
// No need to set format here explicitly if contentNegotiator behavior is active,
//\Yii::$app->response->format = Response::FORMAT_JSON;
\Yii::$app->response->statusCode = 200;
return [
'csrfParam' => $request->csrfParam,
'csrfToken' => $token,
];
}
(2025-05-23T18:51:19.365Z) [All cookies via js-cookie:]
{_csrf: 'cf311952abef22898e59561b0f730a118d4aae4d893228c819…rf";i:1;s:32:"Cy-WXJPmj8I3r9zdn4UaHAMs3GYK1oQ8";}'}
_csrf
:
"cf311952abef22898e59561b0f730a118d4aae4d893228c8192edc58863ba9aea:2:{i:0;s:5:\"_csrf\";i:1;s:32:\"Cy-WXJPmj8I3r9zdn4UaHAMs3GYK1oQ8\";}"
[[Prototype]]
:
Object
loggerUtils.ts:235 (2025-05-23T18:51:19.365Z) [csrfServices.ts] Could not fetch CSRF token from backend Error: CSRF token cookie missing.
at fetchCsrfToken (csrfServices.ts:62:9)
at async csrfServices.ts:110:38
loggerUtils.ts:151 (2025-05-23T18:51:19.366Z) [All cookies via js-cookie:]
{_csrf: 'cf311952abef22898e59561b0f730a118d4aae4d893228c819…rf";i:1;s:32:"Cy-WXJPmj8I3r9zdn4UaHAMs3GYK1oQ8";}'}
_csrf
:
"cf311952abef22898e59561b0f730a118d4aae4d893228c8192edc58863ba9aea:2:{i:0;s:5:\"_csrf\";i:1;s:32:\"Cy-WXJPmj8I3r9zdn4UaHAMs3GYK1oQ8\";}"
[[Prototype]]
:
Object
// src/services/csrfServices.ts
import Cookies from 'js-cookie';
import apiClient from './apiClientServices';
import { ENDPOINTS } from '../constants/apiConstants';
import logger from '../utils/loggerUtils';
/**
* CSRF Token manager class.
* Handles fetching token from backend, reading from cookie,
* caching token internally, and providing easy access.
*
* On app startup, call:
*
* await csrfTokenManager.init();
*
* In your axios interceptor (or wherever you send API requests):
*
* import { csrfTokenManager } from './csrfServices';
*
* apiClient.interceptors.request.use(config =>
* {
* const token = csrfTokenManager.getToken();
* if (token)
* {
* config.headers['X-CSRF-Token'] = token;
* }
*
* return config;
* });
*/
export const CSRF_COOKIE_NAME = 'csrfToken';
export type CsrfData =
{
csrfParam: string;
csrfToken: string;
};
/**
* Fetch the CSRF token and param from the backend endpoint.
* This triggers the backend to set the CSRF cookie.
* Throws an error if token or param are missing.
*/
export async function fetchCsrfToken(): Promise<CsrfData>
{
const response = await apiClient.get(ENDPOINTS.security.csrfToken);
const { csrfParam, csrfToken } = response.data;
if (!csrfParam || !csrfToken)
{
throw new Error('Failed to fetch CSRF token');
}
// wait 50-100ms to allow cookie to become available
await new Promise(resolve => setTimeout(resolve, 50));
const cookieToken = getCsrfTokenFromCookie();
if (!cookieToken)
{
throw new Error('CSRF token cookie missing.');
}
logger.log('csrfServices.ts', 'Token from backend response:', csrfToken);
if (cookieToken.trim() !== csrfToken.trim())
{
throw new Error(`CSRF tokens mismatch. Cookie: ${cookieToken}, Backend: ${csrfToken}`);
}
logger.log('csrfServices.ts', 'Token from cookie:', cookieToken);
return { csrfParam, csrfToken };
}
/**
* Read the CSRF token directly from the CSRF cookie.
* Returns undefined if cookie is missing.
*/
export function getCsrfTokenFromCookie(): string | undefined
{
logger.log('All cookies via js-cookie:', Cookies.get());
return Cookies.get(CSRF_COOKIE_NAME);
}
class CsrfTokenManager
{
private csrfParam?: string;
private csrfToken?: string;
private initPromise?: Promise<void>;
/**
* Initialize the token manager by fetching token from backend,
* and then synchronizing with the token in cookie.
* Call once on app startup.
*/
async init(): Promise<void>
{
if (this.initPromise)
{
return this.initPromise;
}
this.initPromise = (async () =>
{
try
{
const { csrfParam, csrfToken } = await fetchCsrfToken();
this.csrfParam = csrfParam;
this.csrfToken = csrfToken;
}
catch (error)
{
logger.warn('csrfServices.ts', 'Could not fetch CSRF token from backend', error);
}
// Override with cookie token if available (more reliable/up-to-date)
const cookieToken = getCsrfTokenFromCookie();
if (cookieToken)
{
this.csrfToken = cookieToken;
}
})();
return this.initPromise;
}
/**
* Get the current CSRF token to be used for headers.
* Prefers cookie token if it exists, else falls back to cached token.
*/
getToken(): string | undefined
{
// Prefer cookie token if available (more up to date)
const cookieToken = getCsrfTokenFromCookie();
if (cookieToken)
{
this.csrfToken = cookieToken;
return cookieToken;
}
// Fall back to fetched token
return this.csrfToken;
}
/**
* Get the CSRF param name (cookie name / form param name).
*/
getParam(): string | undefined
{
return this.csrfParam;
}
/* Optional setter if you want to manually update tokens
setToken(token: string, param?: string): void
{
this.csrfToken = token;
if (param)
{
this.csrfParam = param;
}
}//*/
}
// Export a singleton CSRF token manager instance to be used app-wide.
export const csrfTokenManager = new CsrfTokenManager();
ASSISTANT
The issue you are experiencing appears to be that the CSRF cookie is not present or not accessible on the frontend after fetching the CSRF token endpoint. Your backend `actionCsrfToken()` action correctly generates and returns the token string, but the browser does not seem to have the corresponding CSRF cookie set, causing your frontend code in `fetchCsrfToken()` to fail with `CSRF token cookie missing.`.
---
## Problem Summary
- Backend generates a valid CSRF token (`RpddH38dvW...`) in the PHP code.
- Logs show the token generated and returned in response JSON.
- However, the cookie `_csrf` on browser side contains an unrelated token value `"cf311952a..."` from a previous or different source.
- The frontend expects a cookie named `csrfToken` (note: your code uses `CSRF_COOKIE_NAME = 'csrfToken'`), but the existing cookie in the browser is named `_csrf` with odd serialized content.
- Your frontend tries to fetch cookie `csrfToken` but doesn't find it → error.
- Your backend logs say "Sending CSRF cookie with params: []", indicating no cookie is added/set in the response.
- The backend code that adds the cookie to the response is commented out:
```php
/*$response->cookies->add(
new Cookie([
'name' => $request->csrfParam,
'value' => $token,
'httpOnly' => false,
'secure' => YII_ENV_PROD ? true : false,
'sameSite' => YII_ENV_PROD ? Cookie::SAME_SITE_NONE : Cookie::SAME_SITE_LAX,
'path' => '/',
])
);//*/
```
So no cookie is actually being sent.
---
## Why the cookie is missing
In Yii2, CSRF cookie is normally automatically sent by the framework **if** the CSRF validation is enabled and if the CSRF token is accessed via `$request->getCsrfToken()` at some point during the request lifecycle. But your API endpoint is explicit and you disabled manual cookie setting by commenting it out.
Since `actionCsrfToken()` only returns the token value in JSON and doesn’t explicitly set the cookie, the cookie never gets sent in the HTTP response headers, thus no new or updated cookie in the browser.
The `js-cookie` library reads `csrfToken` cookie but it doesn't exist. There might be an old `_csrf` cookie, but that's unrelated to `csrfToken`. Also the cookie value for `_csrf` appears to be a serialized string, which your frontend is not prepared to parse.
---
## How to fix this
### Option 1: Explicitly Set CSRF Cookie from Backend
Uncomment and fix the cookie-setting code in the backend method `actionCsrfToken()` so the cookie is actually sent as an HTTP `Set-Cookie` header.
```php
use yii\web\Cookie;
// ...
$response->cookies->add(
new Cookie([
'name' => $request->csrfParam, // typically '_csrf'
'value' => $token,
'httpOnly' => false, // allow JS to read it
'secure' => YII_ENV_PROD ? true : false,
'sameSite' => YII_ENV_PROD ? Cookie::SAME_SITE_NONE : Cookie::SAME_SITE_LAX,
'path' => '/',
])
);
```
Make sure:
- `name` matches what your frontend expects (`csrfToken` or `_csrf`). Your frontend code expects `csrfToken`. If Yii uses `_csrf` by default, you may want to rename the cookie or adjust frontend to use `_csrf`.
- `httpOnly` is `false` so your JS can read it.
- `secure` is `true` only if you serve over HTTPS in production.
- `sameSite` configured according to your frontend/backend domain setup. For cross-site, `None` with `Secure` is needed.
This will make sure the Set-Cookie header is sent in the response, and the cookie is stored in browser.
---
### Option 2: Align Frontend Cookie Name with Backend
Your frontend looks for `csrfToken` cookie (`CSRF_COOKIE_NAME = 'csrfToken'`), but Yii2's default CSRF cookie name is `_csrf`. You can either:
- Change frontend constant to:
```ts
export const CSRF_COOKIE_NAME = '_csrf';
```
- Or change backend cookie name:
```php
$response->cookies->add(
new Cookie([
'name' => 'csrfToken', // matches frontend
'value' => $token,
// other options...
])
);
```
Make sure naming matches both sides.
---
### Option 3: Clear or Fix Existing Cookies
The current `_csrf` cookie value looks like PHP serialized data:
```
"cf311952abef22898e59561b0f730a118d4aae4d893228c8192edc58863ba9aea:2:{i:0;s:5:\"_csrf\";i:1;s:32:\"Cy-WXJPmj8I3r9zdn4UaHAMs3GYK1oQ8\";}"
```
This suggests that older Yii code or session components may be setting cookies in serialized format, or some legacy/buggy code is doing this.
This invalid cookie data might confuse your frontend code. To fix:
- Clear existing cookies in browser storage, especially `_csrf`.
- Confirm that backend sends a "clean" cookie with the string token you want.
- Avoid mixing serialized and raw string cookie values.
---
### Option 4: Let Yii deal with CSRF cookie automatically
If your API uses Yii's built-in CSRF validation, and you call `$request->getCsrfToken()` during request, Yii should automatically set CSRF cookie on the response.
Make sure CSRF validation component is enabled in your application config:
```php
'request' => [
'enableCsrfValidation' => true,
// ...
],
```
If you don't manually disable CSRF cookie generation, and you access the token, cookie will be sent automatically.
Then you can avoid manual cookie setting.
---
## Summary & Recommendations
**Minimal fix:**
- Uncomment and use the cookie set code in backend so the cookie is sent to client.
- Ensure cookie name matches the frontend expectations (`csrfToken` or `_csrf`).
- Make sure your frontend reads the correct cookie name in `CSRF_COOKIE_NAME`.
- Clear old or mismatched cookies in browser.
- Use `httpOnly=false` so JS can access the cookie.
- Ensure `secure` and `sameSite` flags match environment deployment.
**Additional tip:**
You might want to log the backend HTTP response headers (`Set-Cookie`) during the CSRF token fetch to confirm the cookie is really sent.
---
## Example Corrected `actionCsrfToken()` snippet:
```php
public function actionCsrfToken(): array
{
$request = \Yii::$app->request;
if (!$request->isGet) {
throw new BadRequestHttpException('Only GET requests are allowed.');
}
$token = $request->getCsrfToken();
\Yii::debug('CSRF Token from getCsrfToken(): ' . $token, __METHOD__);
$response = \Yii::$app->response;
// Add CSRF cookie explicitly
$response->cookies->add(
new Cookie([
'name' => 'csrfToken', // ensure this matches frontend
'value' => $token,
'httpOnly' => false,
'secure' => YII_ENV_PROD ? true : false,
'sameSite' => YII_ENV_PROD ? Cookie::SAME_SITE_NONE : Cookie::SAME_SITE_LAX,
'path' => '/',
])
);
\Yii::info("CSRF token to send to client: $token", __METHOD__);
\Yii::info('Sending CSRF cookie with params: ' . json_encode($response->cookies->toArray()), __METHOD__);
\Yii::$app->response->statusCode = 200;
return [
'csrfParam' => $request->csrfParam,
'csrfToken' => $token,
];
}
```
---
Let me know if you want help modifying frontend accordingly or if you have questions about cookie security flags (SameSite, secure, etc.) for your deployment!