Server-side service, browser flows and CSRF cookies problem

[InverMN]

Hi, last time I upgraded Kratos from v0.6 to v0.7 and my server-side self-service stopped working. After a search, I found on the Kratos Github Releases page, that <kratos-admin>/self-service/*/flows endpoints have been deleted.

If a self-service flow for browsers is requested, the CSRF cookie must be included in the call, regardless if it is a client-side browser app or a server-side browser app calling.

But in docs, there is written there's no need for providing CSRF cookie and self-service should use admin endpoints.

How should I interpret these?

[aeneasr]

That section is outdated, we need to update it. Please see the changelog for 0.7: https://github.com/ory/kratos/blob/master/CHANGELOG.md#070-alpha1-2021-07-13

[InverMN]

So... I must get CSRF cookie? That will be kkinda painful workflow, I think

[aeneasr]

If your UI and Ory Kratos are on the same domain, it's really not a problem. Check out how we solved it:

https://github.com/ory/kratos-selfservice-ui-node/blob/782f20cb023c140b230dfa0f5358c76999e9b938/src/routes/login.ts#L25

We also updated documentation on more examples etc:

https://www.ory.sh/kratos/docs/self-service/flows/user-login

More context: #1282