<p>I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft cms plugin - <a href="https://github.com/dukt/like" rel="nofollow noreferrer">https://github.com/dukt/like</a></p>

<p>So far the user is able to sign up, login and logout. However I’m having issues with accessing the renewed CSRF token when then the user logs in. I am accessing the CSRF token as per the documentation - <a href="https://craftcms.com/support/csrf-protection#updating-your-javascript" rel="nofollow noreferrer">https://craftcms.com/support/csrf-protection#updating-your-javascript</a>. So these are currently the steps of the CSRF token login process.</p>

<p>1) User lands on website and the CSRF token is created e.g.
pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL</p>

<p>2) User logs in (updated CSRF token is generated, don’t have access to it unless I refresh the page).</p>

<p>3) User likes an entry (400 error ’The CSRF token could not be verified.’).</p>

<p>4) Refresh the page 
CSRF Token = pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL\x7C42101f4b43f2bc331d376d055c77c8f7146d30e4</p>

<p>5) User can now like an entry.</p>

<p>I’ve tried to get the updated CSRF token from the cookie, but I can’t access it via document.cookie for security because they are tagged httponly.</p>

<p>Is there a way to get the updated value of the CSRF token? Possibly after the login action?</p>

<p>Thanks for any help! </p>

CC BY-SA 3.0
2017-09-29T11:54:55.967Z
You could perhaps add the CSRF token to your HTTP responses via `craft()->request->getCsrfToken()`?
Maarten de Graaf
CC BY-SA 3.0
2018-01-15T09:38:38.230Z
Did you manage to figure this out? I have the same issue.
Daniel
CC BY-SA 3.0
2018-01-19T17:00:38.310Z
OP and @Daniel did either of you work it out? Think I’m running into the same issue.
Josh Angell
CC BY-SA 3.0
2018-01-19T21:00:01.960Z
@JoshAngell well basically what I ended up doing was to create a new endpoint in element spi that simply returns a new token after a post request has been made, then store that into my app's state to be used again
Daniel
CC BY-SA 3.0
2018-01-19T21:01:13.107Z
@Daniel Yeah I’m trying something similar but still getting the issue ... are you fetching that endpoint with GET or POST?
Josh Angell
CC BY-SA 3.0
2018-01-20T09:52:18.950Z
@JoshAngell with a GET - if you fetch it with a POST the csrf token will change again so will never be up to date
Daniel
CC BY-SA 4.0
2018-05-24T17:10:22.040Z
Don't you think this is a great opportunity to write a sample code in the answer section?
krizajb
<ajax><javascript><csrf>
How to access logged in CSRF token?
# How to access logged in CSRF token?

(Asked by: username_0 on 2017-09-29)

I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft cms plugin - <https://github.com/dukt/like>

So far the user is able to sign up, login and logout. However I’m having issues with accessing the renewed CSRF token when then the user logs in. I am accessing the CSRF token as per the documentation - <https://craftcms.com/support/csrf-protection#updating-your-javascript>. So these are currently the steps of the CSRF token login process.

1) User lands on website and the CSRF token is created e.g.
pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL

2) User logs in (updated CSRF token is generated, don’t have access to it unless I refresh the page).

3) User likes an entry (400 error ’The CSRF token could not be verified.’).

4) Refresh the page
CSRF Token = pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL\x7C42101f4b43f2bc331d376d055c77c8f7146d30e4

5) User can now like an entry.

I’ve tried to get the updated CSRF token from the cookie, but I can’t access it via document.cookie for security because they are tagged httponly.

Is there a way to get the updated value of the CSRF token? Possibly after the login action?

Thanks for any help!

**Tags:** ajax, javascript, csrf

> **Comments:**
> **username_1**: You could perhaps add the CSRF token to your HTTP responses via `craft()->request->getCsrfToken()`?  
> **username_2**: Did you manage to figure this out? I have the same issue.  
> **username_3**: OP and @username_2 did either of you work it out? Think I’m running into the same issue.  
> **username_2**: @JoshAngell well basically what I ended up doing was to create a new endpoint in element spi that simply returns a new token after a post request has been made, then store that into my app's state to be used again  
> **username_3**: @username_2 Yeah I’m trying something similar but still getting the issue ... are you fetching that endpoint with GET or POST?  
> **username_2**: @JoshAngell with a GET - if you fetch it with a POST the csrf token will change again so will never be up to date  
> **username_4**: Don't you think this is a great opportunity to write a sample code in the answer section?  

---

## 0 answers

