From fd1fa7dbeb7391b945e8fc8839632f04a8b1125b Mon Sep 17 00:00:00 2001 From: cclohmar Date: Tue, 7 Jul 2026 16:08:20 +0100 Subject: [PATCH] =?UTF-8?q?fix:=20CSRF=20token=20=E2=80=94=20clear=20jar?= =?UTF-8?q?=20before=20first=20fetch,=20preserve=20session=20across=20call?= =?UTF-8?q?s?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy.sh | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/deploy.sh b/deploy.sh index d59b9ad..a753806 100755 --- a/deploy.sh +++ b/deploy.sh @@ -265,12 +265,26 @@ EOF sleep 1 COOKIE_JAR="/tmp/zoraxy_cookies.txt" - rm -f "$COOKIE_JAR" + + # Helper: fetch CSRF token from Zoraxy login page + # Uses $COOKIE_JAR — appends cookies, preserves existing session fetch_csrf() { - curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' + local page + page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1) + local token + token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//') + echo "$token" } + # First call — fresh cookie jar + rm -f "$COOKIE_JAR" CSRF=$(fetch_csrf) + if [ -z "$CSRF" ]; then + echo " [WARN] No CSRF token found, sleeping 3s and retrying..." + sleep 3 + CSRF=$(fetch_csrf) + fi + ADMIN_CREATE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \ -H "X-CSRF-Token: ${CSRF}" \ -d "username=${ADMIN_USERNAME:-master}" \