fix: session cookie

Author: delcroip

core/schema.py

@@ -338,16 +338,15 @@ def mutate_and_get_payload(cls, root, info, **data):
         request = getattr(info, "context", None)
 
         user_agent = request.headers.get("User-Agent", "")
-        current_session_key = request.session.session_key
-        if not is_this_session_superuser(current_session_key):
-            if not any(
-                bypass in user_agent
-                for bypass in getattr(settings, "USER_AGENT_CSRF_BYPASS", [])
-            ):
-                csrf_middleware = CsrfViewMiddleware(lambda req: None)
-                reason = csrf_middleware.process_view(request, None, (), {})
-                if reason:
-                    raise PermissionDenied("CSRF token missing or incorrect.")
+       
+        if not any(
+            bypass in user_agent
+            for bypass in getattr(settings, "USER_AGENT_CSRF_BYPASS", [])
+        ):
+            session_csrf = request.session['csrftoken']
+            request_csrf = request.META['HTTP_X_CSRFTOKEN']
+            if session_csrf != request_csrf:
+                raise PermissionDenied("CSRF token missing or incorrect.")
 
         mutation_log = MutationLog.objects.create(
             json_content=json.dumps(data, cls=OpenIMISJSONEncoder),
@@ -649,16 +648,15 @@ def resolve_queryset(
             raise PermissionDenied(_("unauthorized"))
 
         user_agent = request.headers.get("User-Agent", "")
-        current_session_key = request.session.session_key
-        if not is_this_session_superuser(current_session_key):
-            if not any(
-                bypass in user_agent
-                for bypass in getattr(settings, "USER_AGENT_CSRF_BYPASS", [])
-            ):
-                csrf_middleware = CsrfViewMiddleware(lambda req: None)
-                reason = csrf_middleware.process_view(request, None, (), {})
-                if reason:
-                    raise PermissionDenied("CSRF token missing or incorrect.")
+
+        if not any(
+            bypass in user_agent
+            for bypass in getattr(settings, "USER_AGENT_CSRF_BYPASS", [])
+        ):
+            session_csrf = request.session['csrftoken']
+            request_csrf = request.META['HTTP_X_CSRFTOKEN']
+            if session_csrf != request_csrf:
+                raise PermissionDenied("CSRF token missing or incorrect.")
 
         qs = super(DjangoFilterConnectionField, cls).resolve_queryset(
             connection, iterable, info, args
@@ -2153,7 +2151,9 @@ def mutate(cls, root, info):
         csrf_token = get_token(info.context)
         if not csrf_token:
             raise GraphQLError("CSRF token could not be generated")
-
+        if info.context and hasattr(info.context, 'session'):
+            info.context.session['csrftoken'] = csrf_token
+            info.context.session.save()
         return GetCsrfTokenMutation(csrf_token=csrf_token)