3x-ui

mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-05-27 07:29:36 +00:00

Files

MHSanaei 3ecdae7c92 fix(csrf): expose token endpoint for SPA pages and fetch it from axios

The legacy panel pages got their CSRF token from a <meta name="csrf-token">
tag rendered by Go. SPA pages built by Vite don't have that, so every
unsafe (POST/PUT/DELETE) request from them was hitting CSRFMiddleware
with no token and getting 403 — visible as the settings page being
stuck on "Loading…" because POST /panel/setting/all failed.

- web/controller/xui.go: GET /panel/csrf-token returns the session
  token. Lives under the xui group so checkLogin still gates it; the
  CSRFMiddleware on the same group is a no-op for GET.
- frontend/src/api/axios-init.js: cache the token at module scope and
  lazy-fetch it when a non-safe request needs one. Seed from the meta
  tag first when present (legacy compat). On a 403 response, drop the
  cache and retry once — handles the case where a server restart
  rotated the token after the SPA loaded.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-08 13:20:26 +02:00

api.go

Implement CSRF protection and security hardening across the application (#4179 )

2026-05-07 23:36:11 +02:00

base.go

docs: add comments for all functions

2025-09-20 09:35:50 +02:00

custom_geo.go

Add SSRF protection (#4044 )

2026-04-20 00:18:20 +02:00

inbound.go

ws/inbounds: realtime fixes + perf for 10k+ client inbounds (#4123 )