02/14/2022, 10:34 PM
So I'm trying to get into Kratos. Coming from a self implemented access tokens / refresh tokens (JWT) solution there are a few things I don’t fully understand: 1. When I want to check if a request is authenticated on my API service, I call the Kratos
endpoint with the requests cookies, right? But this doesn’t prevent CSRF attack (the way an in memory access token would), or am I missing something? 2. With the refresh token it was possible to have to user be authenticated without interaction for an indefinite time, if said user visited the site regularly. I found the
, but here the user actually has to enter the password again. Is there another way to refresh the session without interaction or what would be best practice to achieve something similar??
Nevermind question 2. I just saw kratos#615.


02/15/2022, 8:47 AM
Hello. Yes you need to call
endpoint to check if the incoming request is authenticated. You can have multidomain and have strict rules to prevent CSRF. Have you checked ‘Advanced Base URL, CSRF & Session Cookie settings’ guide?


02/15/2022, 9:24 AM
Didn't see this guide before, but I just had a look at it. You mean setting the
attribute to Strict?