In the previous video, we looked at how to resolve a CSR official by disabling and deadly insider Web
application, but in this video, let's try to explore how to handle CSR properly by generating a CSR
token on the backend and maintain the same, by the way, for further communications between the front
end and back.
For the same, let's go to the same place where we disable the CSR.
If are disabled, called the SRF token repository and CSR token repository will accept any implementation
that generator CSR of tokens and pass on to the UI through cookies or any of that approach.
So in this scenario, I will try to take CSR one repository, which is an implementation provided by
spring security.
By default.
We can go and see inside this bus here by default, CSR Goken will be generated and will be passed on
to the UI under the name axis of hyphen token.
Now we have made CSR configurations on the back and say to generate a token every time a first request
is coming from the UI application with its GDP, only Folt will make sure that token or cookie can be
read by our UI application.
That's where we can configure sample token repository followed by unmetered, since we want to maintain
these configurations also by doing security.
Now we are set on the backend, but on the Frinton application also, we should make sure that we are
capturing this token and parsing every time to the backend so that all my board delete are state.
Changing operations will be successfully as long as the tokens are same, which are being maintained
by both you and the back button and go to the front, end quote.
You can see login that component Barbas, which will call my login service to perform the login operation.
Once I get the response, I'm saving the user details inside the sition storage.
Similarly, before navigating to the dashboard, I feel the conduct is received from the backend inside
a variable called of hyphen, token, industrial and storage of my application.
Further, I just have to call the get cookie, which is a utility method that I have written.
It will look for the cookie with the name given for the matter and pass the value inside that cookie.
So once I have that value, I will store inside my sition storage with the same name and its corresponding
value.
With this we are saving, but the next step is we should make sure we are passing the same token for
all the for the request for that.
We can make changes inside our interceptor class and we discuss.
Interceptor has a method called intercept, which will be called every time by ANGULAR when we are sending
a request to a package service inside this intercept method.
Let's try to fix the exercise of token that we already stored in the kitchen storage every time and
passes that value inside their value so that the same value will be passed on to the back end.
Also, since the tokens will be same both on the front end and back in during the communications that
are happening, the server also will not complain anything.
Now I just pulling the value from position storage and I add in the headers with the header name hyphen
Exocet of hyphen token, which is expected from the spring security.
Now we make changes both on the front end and back.
And I'll also keep a breakpoint for your reference, so that we can see what is happening when we are
performing it, logging of the application and any further requests are going through the application.
So I'm just launching the browser very first time.
I'm just entering the credentials and it will be intercepted by my interceptor since this is making
a get request to the back end to validate the user details.
And since this is going very first time to the back and our accessories will be null and they won't
be any harder at it.
Now, I got a response from the back end and we can see there is a cookie that we received and the value
inside that is this value which and displaying it starts with B nine four and now I'm storing that data
inside.
Mentioned storage.
If you go to the browser now, we are into the dashboard.
Now, if I click on this balance or loans, any of these sections, I should get a valid response.
We are passing the acquisitive token again and again for every request that is happening.
So now there is a breakpoint stopped here.
And since the request has been intercepted, it will try to look for the same Exocet of value that we
store previously and it will add to the headers since this is going to the back end with the reality
of sort of GOKEN, we should get the response from the back.
Similarly, if you go and look for balance, also, we should get the response.
The same applies for cards as well.
And you can see all the communication with the back end is happening seamlessly because now we handle
the CSIRO in a proper manner by generating its CSR.
But now let's try to test the remaining services.
Also, like I have a contact us and notices so notices again, it is calling the database using a method
and try to fetch all the notices associated in the database.
And all those notices are being displayed here.
But if you go and click the contact us, this is a put request.
And since this is there is no security alert for this contact, but we are free to access it even without
logging it.
So I'm just making and contact message to the bank by entering some details.
Name is Materne emails and all the read Yahoo dot com.
Please connect with me regarding home.
No.
OK, so as soon as I click send message, nothing is happening.
And if you go and see again we are getting it for error.
Let's try to look into that in the next.
Thank you.
And by.