From 3a302eaae73ab37f1668776cddfc7ad459a6226d Mon Sep 17 00:00:00 2001
From: Elias Nahum <nahumhbl@gmail.com>
Date: Thu, 23 Apr 2020 06:01:20 -0400
Subject: [PATCH] MM-24385 Fix ExperimentalStrictCSRFEnforcement (#4207)

---
 app/actions/views/user.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/actions/views/user.js b/app/actions/views/user.js
index 27b6d8464..3067977b0 100644
--- a/app/actions/views/user.js
+++ b/app/actions/views/user.js
@@ -29,7 +29,6 @@ export function completeLogin(user, deviceToken) {
         const token = Client4.getToken();
         const url = Client4.getUrl();
 
-        setCSRFFromCookie(url);
         setAppCredentials(deviceToken, user.id, token, url);
 
         // Set timezone
@@ -168,6 +167,7 @@ export function login(loginId, password, mfaToken, ldapOnly = false) {
 
         try {
             user = await Client4.login(loginId, password, mfaToken, deviceToken, ldapOnly);
+            await setCSRFFromCookie(Client4.getUrl());
         } catch (error) {
             return {error};
         }
@@ -185,6 +185,7 @@ export function login(loginId, password, mfaToken, ldapOnly = false) {
 export function ssoLogin(token) {
     return async (dispatch) => {
         Client4.setToken(token);
+        await setCSRFFromCookie(Client4.getUrl());
         const result = await dispatch(loadMe());
 
         if (!result.error) {
@@ -215,7 +216,7 @@ export function forceLogoutIfNecessary(error) {
         const state = getState();
         const currentUserId = getCurrentUserId(state);
 
-        if (currentUserId && error.status_code === HTTP_UNAUTHORIZED && error.url && !error.url.includes('/login')) {
+        if (error.status_code === HTTP_UNAUTHORIZED && error.url && !error.url.includes('/login')) {
             dispatch(logout(true));
             return true;
         }