fix: added CSRF check for granting access via session authentication

api/src/routes/web/index.ts

@@ -4,6 +4,13 @@ import webRouter from './web'
 
 const router = express.Router()
 
-router.use('/', csrfProtection, webRouter)
+router.use(csrfProtection)
+
+router.use(function (req, res, next) {
+  res.cookie('XSRF-TOKEN', req.csrfToken())
+  next()
+})
+
+router.use('/', webRouter)
 
 export default router