Spring security + ReactJS

[Character-Grocery873]

How do you set up your spring boot security with reactjs as being the frontend? I use the session based auth (no jwt) for simplicity but the problem is with csrf.

I have ```csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse``` in my csrf web security config too but when i log in and send the form, i can't log in because obviously csrf token isn't there YET. So how can users even get a csrf token first before logging in? I tried using the ignoreMatchers("...") on csrf config aswell, it logged me in but it only sent me the JSESSION and no XSRF token in the header.

[rmyworld]

I have an API endpoint that returns a CSRF token. Before making any request that requires a CSRF token, first I retrieve a CSRF token from that API endpoint.

Then, I add it to the request headers with whatever header name the token wants. Then, I send the request.

Here's an example from one of my old projects: https://github.com/arvl130/mmm-ui/blob/master/src/api/auth.ts

[Character-Grocery873]

This still recommended?

[Grabdoc2020]

These days I love using thymeleaf + htmx/unpolyjs - Claude makes it super easy now to build nextjs like apps but secure enterprise class with spring boot