From 53c6a64a3c1afb5c0baeed8be43a3a044a37e228 Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Sun, 15 Feb 2026 22:23:05 +0100
Subject: [PATCH] fixed csrf token sending

---
 frontend/src/api.ts | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 8fc3df2..d1fef31 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -1,14 +1,41 @@
 import axios from 'axios';
 
+function getCookie(name: string): string | null {
+    let cookieValue = null;
+    if (document.cookie && document.cookie !== '') {
+        const cookies = document.cookie.split(';');
+        for (let i = 0; i < cookies.length; i++) {
+            const cookie = cookies[i].trim();
+            // Does this cookie string begin with the name we want?
+            if (cookie.substring(0, name.length + 1) === (name + '=')) {
+                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+                break;
+            }
+        }
+    }
+    return cookieValue;
+}
+
 const api = axios.create({
   baseURL: import.meta.env.VITE_API_URL || 'http://localhost:8000/api/',
 });
 
 api.interceptors.request.use((config) => {
+  // Set DRF Auth Token if available from localStorage
   const token = localStorage.getItem('token');
   if (token) {
     config.headers.Authorization = `Token ${token}`;
   }
+
+  // Set CSRF token for state-changing methods
+  const csrfToken = getCookie('csrftoken');
+  const method = config.method?.toUpperCase();
+  if (csrfToken && method && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
+      if (config.headers) {
+          config.headers['X-CSRFToken'] = csrfToken;
+      }
+  }
+
   return config;
 });