Actually, figured it out! I would like to tell you what I did, but I really don't know. I broke my CSRF tokens, then in pure panic fixed it by messing around with the nginx config.
But let me show you what is working:
The nginx config above (I edited it with the new one)
This code here for the Logout:
updateUserNavForLoggedInUser(userData) {
const navContainer = document.getElementById('elUserNav');
const userPicture = userData.picture
? `<a href="https://discussions.codenamejessica.com/user/${userData.username}" rel="nofollow" class="nodebbUserPhoto nodebbUserPhoto--fluid nodebbUserNav__link" title="Go to ${userData.username}'s profile">
<img src="${userData.picture}" alt="${userData.username}" class="nodebbUserNav__avatar">
</a>`
: `<a href="https://discussions.codenamejessica.com/user/${userData.username}" rel="nofollow" data-nodebb-hook="userNoPhotoWithUrl" class="nodebbUserPhoto nodebbUserPhoto--fluid nodebbUserNav__link" title="Go to ${userData.username}'s profile">
<div class="nodeBBNavNoPhotoTile">
${this.getInitial(userData.username)}
</div>
</a>`;
navContainer.innerHTML = `
<li data-el="profile">
${userPicture}
</li>
<li data-el="logout">
<button class="nodebbUserNav__link" id="logoutButton">
<i class="fa-solid fa-right-from-bracket" aria-hidden="true"></i>
<span class="nodebbUserNav__text">Log Out</span>
</button>
</li>
`;
// Attach the logout functionality to the button
document.getElementById('logoutButton').addEventListener('click', this.logoutUser);
},
logoutUser() {
axios.get('https://discussions.codenamejessica.com/api/config', {
withCredentials: true, // Include cookies
})
.then(response => {
const csrfToken = response.data.csrf_token; // Extract CSRF token
return axios.post('https://discussions.codenamejessica.com/logout', {}, {
withCredentials: true, // Include cookies
headers: {
'x-csrf-token': csrfToken, // Use retrieved CSRF token
},
});
})
.then(() => {
window.location.href = 'https://codenamejessica.com/';
})
.catch(error => {
console.error('Error logging out:', error);
alert('Failed to log out. Please try again.');
});
},
Ultimately It took getting the user's x-csrf token, which I acquired by adding the x-csrf items and adding the logout to the api section of the nginx config. Then I was able to acquire the x-csrf from the const csrfToken = response.data.csrf_token;. Sending that in with a post, and redirect back to the website.
AGGHHH! That was hard! Don't judge me, I see your eyes giving me those looks.
