Merge branch 'dm-api-current-user' into 'master'

Do not validate CSRF token in API unless needed

Closes #35705

See merge request !13256

2 files changed, 3 insertions, 1 deletions

diff --git a/lib/api/api.rb b/lib/api/api.rb
index e08f4e2995f..982a2b88d62 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -48,8 +48,8 @@ module API
     end
 
     before { header['X-Frame-Options'] = 'SAMEORIGIN' }
-    before { Gitlab::I18n.locale = current_user&.preferred_language }
 
+    # The locale is set to the current user's locale when `current_user` is loaded
     after { Gitlab::I18n.use_default_locale }
 
     rescue_from Gitlab::Access::AccessDeniedError do
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 234825480f2..99b8b62691f 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -16,6 +16,8 @@ module API
 
       @current_user = initial_current_user
 
+      Gitlab::I18n.locale = @current_user&.preferred_language
+
       sudo!
 
       @current_user