csrf/token_injection

XMLHttpRequest CSRF token header injection

Override XMLHttpRequest.prototype.open() to automatically add CSRF token header to unsafe HTTP methods. JavaScript code: const csrf_token = document.querySelector("meta[name='csrf-token']").getAttribute("content"); const csrfSafeMethod = (method) => /^(GET|HEAD|OPTIONS)$/.test(method); const originalOpen = XMLHttpRequest.prototype.open; XMLHttpRequest.prototype.open = function(...args) { const result = originalOpen.apply(this, args); if (!csrfSafeMethod(args[0])) { this.setRequestHeader('X-CSRF-Token', csrf_token); } return result; };