Add xsrf token header if cookie is present (#11034)

Fixes #9471

1 files changed, 11 insertions, 0 deletions

diff --git a/server/src/main/resources/VAADIN/vaadinBootstrap.js b/server/src/main/resources/VAADIN/vaadinBootstrap.js
index 7cf133ac56..a6830f434b 100644
--- a/server/src/main/resources/VAADIN/vaadinBootstrap.js
+++ b/server/src/main/resources/VAADIN/vaadinBootstrap.js
@@ -37,6 +37,11 @@
         }
     };
 
+    var getCookie = function (cname) {
+        var b = document.cookie.match('(^|;)\\s*' + cname + '\\s*=\\s*([^;]+)');
+        return b ? b.pop() : '';
+    };
+
     var isWidgetsetLoaded = function (widgetset) {
         var className = widgetset.replace(/\./g, "_");
         return (typeof window[className]) != "undefined";
@@ -195,6 +200,12 @@
                 };
                 // send parameters as POST data
                 r.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+
+                var xsrfToken = getCookie("XSRF-TOKEN");
+                if (xsrfToken && xsrfToken.length > 0) {
+                    r.setRequestHeader("X-XSRF-TOKEN", xsrfToken);
+                }
+
                 r.send(params);
 
                 log('sending request to ', url);