# CSRF on /login security alert from security scans

**URL:** <https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667>\
**Category:** Self-hosting\
**Created:** [December 19, 2018, 1:23pm UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667 "2018-12-19T13:23:42Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [December 19, 2018, 5:42pm UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667/7 "2018-12-19T17:42:00Z")

</div>

> [@jlaura](#):
>
> It looks like the the CSRF token is not granted until the user logs in

From our security doc:

> [@](#):
>
> Certain pages are “cachable”, we do not render the CSRF token ( `<meta name='csrf-token' ...` ) on any cachable pages. Instead when users are about to perform the first non GET request they retrieve the token just in time via `GET session/csrf`

And the relevent piece of the code which fetches the CSRF code before performing the request:

[https://github.com/discourse/discourse/blob/master/app/assets/javascripts/discourse/lib/ajax.js.es6#L149-L166](https://github.com/discourse/discourse/blob/master/app/assets/javascripts/discourse/lib/ajax.js.es6#L149-L166)

---

_[View the full topic](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667)._