fix: Fix csrf token

Author: tjtanjin

config/env/.env.template

@@ -59,4 +59,7 @@ LOG_LEVEL=INFO
 
 # OpenTelemetry Configuration
 OTEL_SERVICE_NAME=otel-collector
-OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
+OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
+
+# CSRF token identifier
+CSRF_TOKEN_IDENTIFIER="LOCAL-XSRF-TOKEN"

src/api/middleware/csrfMiddleware.ts

@@ -10,8 +10,10 @@ const csrfMiddleware: RequestHandler = (req, res, next) => {
     if (!req.session.csrfToken) {
       req.session.csrfToken = tokens.secretSync();
     }
+
     // send token to client (either as a cookie or in locals for your /csrf-token endpoint)
-    res.cookie('XSRF-TOKEN', tokens.create(req.session.csrfToken), {
+    const cookieName = process.env.CSRF_TOKEN_IDENTIFIER || 'XSRF-TOKEN';
+    res.cookie(cookieName, tokens.create(req.session.csrfToken), {
       // false so client-side can read it
       httpOnly: false,
       // if developing locally, set to insecure