Good practice for CSRF-safety after login?

https://doc.nette.org/…y-protection#…

Ok – I changed my original question related to the answer.. :)

Here is a more serious question:
Starting from one presenter, I have a User with Identity.
How can I pass this to another presenter?
(So that I can ask if user->isLoggedIn() there..)

Thank you, Marek,
but now I have configured cookie storage…
Then what to do ?-

It works.
I had to amend the configuration:

security:
	authentication:
		expiration: 20 minutes
		storage: cookie
		cookieName: mycookiename
		cookieSamesite: Strict
		cookieDomain: 'mydomain.local'

cookieSamesite: Lax didn't change anything.
But cookieDomain: 'mydomain.local' did.
(Behavior like stated here?: https://doc.nette.org/…onfiguration#… )

And: why is cookieHttpOnly in Response deprecated?
(https://api.nette.org/…esponse.html )
Is this feature replaced by another, that prevents handling with JS?

Last edited by Nicolas_K (2023-07-15 21:53)

Thank you very much, Marek!
Again, some fog is blowing away.. !-))