Update client.ts

src/api/client.ts

@@ -6,6 +6,32 @@ const API_BASE_URL = import.meta.env.VITE_API_URL || '/api'
 // Настраиваем endpoint для refresh
 tokenRefreshManager.setRefreshEndpoint(`${API_BASE_URL}/cabinet/auth/refresh`)
 
+// CSRF token management
+const CSRF_COOKIE_NAME = 'csrf_token'
+const CSRF_HEADER_NAME = 'X-CSRF-Token'
+
+function getCsrfToken(): string | null {
+  if (typeof document === 'undefined') return null
+  const match = document.cookie.match(new RegExp(`(^| )${CSRF_COOKIE_NAME}=([^;]+)`))
+  return match ? match[2] : null
+}
+
+function generateCsrfToken(): string {
+  const array = new Uint8Array(32)
+  crypto.getRandomValues(array)
+  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('')
+}
+
+function ensureCsrfToken(): string {
+  let token = getCsrfToken()
+  if (!token) {
+    token = generateCsrfToken()
+    // Set cookie with SameSite=Strict for CSRF protection
+    document.cookie = `${CSRF_COOKIE_NAME}=${token}; path=/; SameSite=Strict; Secure`
+  }
+  return token
+}
+
 const getTelegramInitData = (): string | null => {
   if (typeof window === 'undefined') return null
 
@@ -51,6 +77,13 @@ apiClient.interceptors.request.use(async (config: InternalAxiosRequestConfig) =>
   if (telegramInitData && config.headers) {
     config.headers['X-Telegram-Init-Data'] = telegramInitData
   }
+
+  // Add CSRF token for state-changing methods
+  const method = config.method?.toUpperCase()
+  if (method && ['POST', 'PUT', 'DELETE', 'PATCH'].includes(method) && config.headers) {
+    config.headers[CSRF_HEADER_NAME] = ensureCsrfToken()
+  }
+
   return config
 })