kemalcr/kemal-csrf

The token is not reseted

erdnaxeli opened this issue · 4 comments

erdnaxeli commented

There is actually a comment saying it is done, but the code doing it is commented, I guess because it is wrong.

I think the code should define a new token, put it in the session and in the cookie.

Is there any reason why there is this comment here?

erdnaxeli commented

Actually I wonder why the token needs to be in the session and in a cookie 🤔

aravindavk commented

2fc90d8#diff-6862fd8f48072799cb861ed7da91eaabc2667b98dde49f18028f90f34218a57bR36 this is the line where it is commented. Someone please answer why this is commented? Because of which the token is not regenerated after use and it continues to use the same every time and making this feature useless!

sdogruyol commented

@aravindavk wow thanks for the spot 👁️ I'll handle this

  • 👍1
  • ❤️1