<p>You could make the CSRF token available via an element API endpoint, then submit the form with that;</p>

<pre><code>'api/csrf-token' =&gt; [
      'elementType' =&gt; GlobalSet::class,
      'paginate' =&gt; false,
      'one' =&gt; true,
      'transformer' =&gt; function () {
        $newCSRFtoken = Craft::$app-&gt;request-&gt;getCsrfToken(); // sets a new CSRF cookie;
        return [
          'csrfTokenName' =&gt; Craft::$app-&gt;config-&gt;general-&gt;csrfTokenName,
          'csrfToken' =&gt; $newCSRFtoken,
        ];
      }
    ],
</code></pre>

<p>*This code is from a user on the discord server, would have linked to it but you can't ¯_(ツ)_/¯</p>

CC BY-SA 4.0
2019-08-30T14:43:55.197Z
2019-09-01T17:31:56.213Z
2019-09-01T17:31:56.213Z
dmatthams
<p>Currently building a mobile app with Phonegap, I'm able to use the Element API for many features, but when comes the time to use Craft as a loggedin user, I run out of ideas.</p>

<p>I read a lot of things about headless Craft, but I found nothing about the proper way to authenticate outside the Craft installation itself.</p>

<p>First, I achieved something semi-decent with a JWT system and a custom controller to perform a login validation, which works great, and allow me to read from Craft on my controller (with <code>$allowAnonymous = true;</code>, unfortunately)</p>

<p>(For curious eyes, it's far from perfect: <a href="https://gist.github.com/rtrudel/49b96ebc93bfd6774ebbe841426e4b6c" rel="nofollow noreferrer">https://gist.github.com/rtrudel/49b96ebc93bfd6774ebbe841426e4b6c</a> ) </p>

<p>But I do not want to turn off CSRF globally, and I need to use <code>users/save-user</code> to save user profile in-app). The CSRF token value returned by <code>Craft::$app-&gt;getRequest();</code> seems not right for the next ajax calls, which return Bad request, unable to verify your data submission.</p>

<p>So, this brings me out of ideas... do I have another way to login my user from my mobile app and to retrieve the CSRF token correctly in order to do that, and for all the ajax calls my app will do once logged in?</p>

<p>My JWT approach is maybe not as good as expected in the use-case, perhaps I have to think different? I'm open to any idea to make it work as it should.</p>

<p>My main concern is security and efficiency. </p>

<p>Thank you!</p>

CC BY-SA 4.0
2019-08-29T16:02:30.397Z
Did you find a solution for this? Trying to do the same.
user1031699
CC BY-SA 4.0
2019-08-30T14:47:28.220Z
@user1031699 posted an answer to this as I'm going to be doing something similar soon https://craftcms.stackexchange.com/a/31379/526
dmatthams
<csrf><headless>
Headless CraftCMS as mobile app backend, requiring login
# Headless CraftCMS as mobile app backend, requiring login

(Asked by: username_0 on 2019-05-26)

Currently building a mobile app with Phonegap, I'm able to use the Element API for many features, but when comes the time to use Craft as a loggedin user, I run out of ideas.

I read a lot of things about headless Craft, but I found nothing about the proper way to authenticate outside the Craft installation itself.

First, I achieved something semi-decent with a JWT system and a custom controller to perform a login validation, which works great, and allow me to read from Craft on my controller (with `$allowAnonymous = true;`, unfortunately)

(For curious eyes, it's far from perfect: <https://gist.github.com/rtrudel/49b96ebc93bfd6774ebbe841426e4b6c> )

But I do not want to turn off CSRF globally, and I need to use `users/save-user` to save user profile in-app). The CSRF token value returned by `Craft::$app->getRequest();` seems not right for the next ajax calls, which return Bad request, unable to verify your data submission.

So, this brings me out of ideas... do I have another way to login my user from my mobile app and to retrieve the CSRF token correctly in order to do that, and for all the ajax calls my app will do once logged in?

My JWT approach is maybe not as good as expected in the use-case, perhaps I have to think different? I'm open to any idea to make it work as it should.

My main concern is security and efficiency.

Thank you!

**Tags:** csrf, headless
> **Comments:**
> **username_1**: Did you find a solution for this? Trying to do the same.  
> **username_2**: @user1031699 posted an answer to this as I'm going to be doing something similar soon https://craftcms.stackexchange.com/a/31379/526  

---

## 1 answers

### Answer by username_2 on 2019-08-30. Score: 3 | Accepted answer

You could make the CSRF token available via an element API endpoint, then submit the form with that;
'api/csrf-token' => [
      'elementType' => GlobalSet::class,
      'paginate' => false,
      'one' => true,
      'transformer' => function () {
        $newCSRFtoken = Craft::$app->request->getCsrfToken(); // sets a new CSRF cookie;
        return [
          'csrfTokenName' => Craft::$app->config->general->csrfTokenName,
          'csrfToken' => $newCSRFtoken,
        ];
      }
    ],

*This code is from a user on the discord server, would have linked to it but you can't ¯_(ツ)_/¯


---

