2

How can we get http.post to set X-CSRFToken header on the request?
The token should be taken from csrftoken cookie, which is set by the backend.
Do we need to use http.send for it?

danbal
  • 1,481
  • 3
  • 14
  • 19

1 Answers1

4

If you look at the source code (https://github.com/evancz/elm-http/blob/3.0.1/src/Http.elm), post is hard-coded with empty (i.e. []) http header. So if you want to have custom header, post does not work, you'll have to use send instead.

Other solution you might want to consider is to enforce CSRF token for all http calls, like this stackoverflow answer suggests.

Community
  • 1
  • 1
Tosh
  • 35,955
  • 11
  • 65
  • 55