Let CSRF Token Be Available

[zmetcalf]

I am not sure if this is an issue or just a lack of understanding on my part, but the CRAFT_CSRF_TOKEN cookie is set as httpOnly on this line:

cms/src/Craft.php

Line 103 in d8e0232

'httpOnly' => true

after being called from here:

cms/src/config/app.web.php

Line 42 in ad74028

$request->csrfCookie = Craft::cookieConfig([], $request);

Should this cookie be hidden from JavaScript? If it isn't available to JavaScript, why is it there?

[zmetcalf]

Also, as a follow up question, is there a better way to force the session other than putting the {{ csrfInput()}} in the template? (re: #1765)

[angrybrad]

Should this cookie be hidden from JavaScript?

Yes, by default. It's reduces attack surface and most installs don't need access to it from JS.

If you have an explicit need where you need to, you can override component behavior in craft/config/app.php.

is there a better way to force the session other than putting the {{ csrfInput()}} in the template?

You can use `{{ craft.app.session.open() }}

[zmetcalf]

Thank you @angrybrad