lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: CSRF token handling with follow redirects and cookie jar

Browse source
This commit is contained in:
Claus Lohmar 2026-07-06 19:04:39 +01:00
parent 57defd7a63
commit 9bc8310db1
1 changed files with 16 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
deploy.sh
View file

@ -107,33 +107,39 @@ ZORAXY_DNS
sleep 2 sleep 2
done done
# Fetch CSRF token from Zoraxy login page # Fetch CSRF token AND session cookie from Zoraxy login page (follow redirect)
CSRF_TOKEN=$(curl -s http://127.0.0.1:8000/ | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "") COOKIE_JAR="/tmp/zoraxy_cookies.txt"
rm -f "$COOKIE_JAR"
LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
if [ -z "$CSRF_TOKEN" ]; then if [ -z "$CSRF_TOKEN" ]; then
echo "[WARN] Could not fetch CSRF token, trying without it..." echo "[WARN] Could not fetch CSRF token, trying without it..."
ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \ ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
-d "username=${ADMIN_USERNAME:-admin}" \ -d "username=${ADMIN_USERNAME:-admin}" \
-d "password=${ADMIN_PASSWORD:-admin}" 2>&1) -d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
else else
ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \ echo "[OK] CSRF token acquired"
ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
-H "X-CSRF-Token: $CSRF_TOKEN" \ -H "X-CSRF-Token: $CSRF_TOKEN" \
-d "username=${ADMIN_USERNAME:-admin}" \ -d "username=${ADMIN_USERNAME:-master}" \
-d "password=${ADMIN_PASSWORD:-admin}" 2>&1) -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
fi fi
if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"User registered\|"registered'; then if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"User registered\|"registered'; then
echo "[OK] Zoraxy admin account created" echo "[OK] Zoraxy admin account created"
elif echo "$ADMIN_CREATE" | grep -qi '"error'; then elif echo "$ADMIN_CREATE" | grep -qi '"error'; then
echo "[WARN] Admin account may already exist: $ADMIN_CREATE" echo "[WARN] Admin account create issue: $ADMIN_CREATE"
else else
echo "[INFO] Admin API response: $ADMIN_CREATE" echo "[INFO] Admin API response: $ADMIN_CREATE"
fi fi
# --- Login to Zoraxy API for authenticated operations --- # --- Login to Zoraxy API for authenticated operations ---
echo "[*] Logging in to Zoraxy API..." echo "[*] Logging in to Zoraxy API..."
COOKIE_JAR="/tmp/zoraxy_cookies.txt" # Re-fetch CSRF token with fresh cookies for login
rm -f "$COOKIE_JAR" LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
LOGIN_RESPONSE=$(curl -s -c "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \ CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
LOGIN_RESPONSE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
-H "X-CSRF-Token: ${CSRF_TOKEN}" \
-d "username=${ADMIN_USERNAME:-master}" \ -d "username=${ADMIN_USERNAME:-master}" \
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}") -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}")