From f536d4ecf56648549653654069b0732027cda3a4 Mon Sep 17 00:00:00 2001
From: hamster1963 <1410514192@qq.com>
Date: Mon, 15 Jun 2026 18:45:29 +0800
Subject: [PATCH] fix(api): implement CSRF token handling for refresh token
 requests

---
 src/lib/nezha-api.ts | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/lib/nezha-api.ts b/src/lib/nezha-api.ts
index 02526c2..8e73d03 100644
--- a/src/lib/nezha-api.ts
+++ b/src/lib/nezha-api.ts
@@ -11,6 +11,22 @@ import type {
 
 let lastestRefreshTokenAt = 0;
 
+const getCookieValue = (name: string): string | undefined => {
+	const cookie = document.cookie
+		.split("; ")
+		.find((item) => item.startsWith(`${name}=`));
+
+	if (!cookie) {
+		return undefined;
+	}
+
+	return decodeURIComponent(cookie.split("=").slice(1).join("="));
+};
+
+const getCsrfToken = (): string => {
+	return getCookieValue("nz-csrf") || "";
+};
+
 export const fetchServerGroup = async (): Promise<ServerGroupResponse> => {
 	const response = await fetch("/api/v1/server-group");
 	const data = await response.json();
@@ -34,7 +50,14 @@ export const fetchLoginUser = async (): Promise<LoginUserResponse> => {
 			Date.now() - lastestRefreshTokenAt > 1000 * 60 * 60)
 	) {
 		lastestRefreshTokenAt = Date.now();
-		fetch("/api/v1/refresh-token");
+		const csrfToken = getCsrfToken();
+		console.log("Refreshing token with CSRF token:", csrfToken);
+		fetch("/api/v1/refresh-token", {
+			method: "POST",
+			headers: {
+				"X-CSRF-Token": csrfToken,
+			},
+		});
 	}
 
 	return data;