Body: <p>I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft cms plugin - <a href="https://github.com/dukt/like" rel="nofollow noreferrer">https://github.com/dukt/like</a></p>
  
  <p>So far the user is able to sign up, login and logout. However I’m having issues with accessing the renewed CSRF token when then the user logs in. I am accessing the CSRF token as per the documentation - <a href="https://craftcms.com/support/csrf-protection#updating-your-javascript" rel="nofollow noreferrer">https://craftcms.com/support/csrf-protection#updating-your-javascript</a>. So these are currently the steps of the CSRF token login process.</p>
  
  <p>1) User lands on website and the CSRF token is created e.g.
  pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL</p>
  
  <p>2) User logs in (updated CSRF token is generated, don’t have access to it unless I refresh the page).</p>
  
  <p>3) User likes an entry (400 error ’The CSRF token could not be verified.’).</p>
  
  <p>4) Refresh the page 
  CSRF Token = pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL\x7C42101f4b43f2bc331d376d055c77c8f7146d30e4</p>
  
  <p>5) User can now like an entry.</p>
  
  <p>I’ve tried to get the updated CSRF token from the cookie, but I can’t access it via document.cookie for security because they are tagged httponly.</p>
  
  <p>Is there a way to get the updated value of the CSRF token? Possibly after the login action?</p>
  
  <p>Thanks for any help! </p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-09-29T11:54:55.967Z
Comments.Text: You could perhaps add the CSRF token to your HTTP responses via `craft()->request->getCsrfToken()`?
Comments.UserDisplayName: Maarten de Graaf
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-15T09:38:38.230Z
Comments.Text: Did you manage to figure this out? I have the same issue.
Comments.UserDisplayName: Daniel
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-19T17:00:38.310Z
Comments.Text: OP and @Daniel did either of you work it out? Think I’m running into the same issue.
Comments.UserDisplayName: Josh Angell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-19T21:00:01.960Z
Comments.Text: @JoshAngell well basically what I ended up doing was to create a new endpoint in element spi that simply returns a new token after a post request has been made, then store that into my app's state to be used again
Comments.UserDisplayName: Daniel
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-19T21:01:13.107Z
Comments.Text: @Daniel Yeah I’m trying something similar but still getting the issue ... are you fetching that endpoint with GET or POST?
Comments.UserDisplayName: Josh Angell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-20T09:52:18.950Z
Comments.Text: @JoshAngell with a GET - if you fetch it with a POST the csrf token will change again so will never be up to date
Comments.UserDisplayName: Daniel
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-05-24T17:10:22.040Z
Comments.Text: Don't you think this is a great opportunity to write a sample code in the answer section?
Comments.UserDisplayName: krizajb
Tags: <ajax><javascript><csrf>
Title: How to access logged in CSRF token?
ThreadText: # How to access logged in CSRF token?
  
  (Asked by: username_0 on 2017-09-29)
  
  I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft cms plugin - <https://github.com/dukt/like>
  
  So far the user is able to sign up, login and logout. However I’m having issues with accessing the renewed CSRF token when then the user logs in. I am accessing the CSRF token as per the documentation - <https://craftcms.com/support/csrf-protection#updating-your-javascript>. So these are currently the steps of the CSRF token login process.
  
  1) User lands on website and the CSRF token is created e.g.
  pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL
  
  2) User logs in (updated CSRF token is generated, don’t have access to it unless I refresh the page).
  
  3) User likes an entry (400 error ’The CSRF token could not be verified.’).
  
  4) Refresh the page
  CSRF Token = pRO1LyYLzxulTZ6ttv17kZ4gBQzTYHeQEpwZI8nL\x7C42101f4b43f2bc331d376d055c77c8f7146d30e4
  
  5) User can now like an entry.
  
  I’ve tried to get the updated CSRF token from the cookie, but I can’t access it via document.cookie for security because they are tagged httponly.
  
  Is there a way to get the updated value of the CSRF token? Possibly after the login action?
  
  Thanks for any help!
  
  **Tags:** ajax, javascript, csrf
  
  > **Comments:**
  > **username_1**: You could perhaps add the CSRF token to your HTTP responses via `craft()->request->getCsrfToken()`?  
  > **username_2**: Did you manage to figure this out? I have the same issue.  
  > **username_3**: OP and @username_2 did either of you work it out? Think I’m running into the same issue.  
  > **username_2**: @username_3 well basically what I ended up doing was to create a new endpoint in element spi that simply returns a new token after a post request has been made, then store that into my app's state to be used again  
  > **username_3**: @username_2 Yeah I’m trying something similar but still getting the issue ... are you fetching that endpoint with GET or POST?  
  > **username_2**: @username_3 with a GET - if you fetch it with a POST the csrf token will change again so will never be up to date  
  > **username_4**: Don't you think this is a great opportunity to write a sample code in the answer section?  
  
  ---
  
  ## 0 answers
  
  