{ "statusCode": 403, "message": "Invalid CSRF Token" }

[sriharikrishna33]

Hi Please Help
I am getting the following error
{ "statusCode": 403, "message": "Invalid CSRF Token" }

1. After login I am creating access token and refresh token and added to the cookie
2. I am calling protected API then I am getting this error { "statusCode": 403, "message": "Invalid CSRF Token" } and when I see response headers _csrf is in cookie.

[huy97]

Thank for your issue.
You can see this issue: #12 (comment)

If it can't help relsove your issue, please comment back here. Thanks

[sriharikrishna33]

Hello @huy97
For every request, do I need to generate a new csrf token? If yes there is any middleware to handle it?

[YBD21]

@post('login')
@csrf()
async login(
@res() res: Response,
@Body() loginData: LoginDTO,
): Promise {

// Some code

}

gives the same error it seems csrf token is not checked ?

please do provide a proper frontend and backend example for how to implement it.

[BayBreezy]

@huy97 If i understand correctly, for this to work with our client, the client has to:

1. Ensure that the x-csrf-token header is sent in the request
2. Ensure that the cookie is sent along with the request

So if both are not true, then it won't work?
Can I not just attach the header ONLY for this to work?
If my API is one that I cannot add all the origins to cors for(can't set credentials to include), how would I use this module?

[huy97]

@BayBreezy
Thank you for using the library. As you mentioned, cookies are required for it to work because the secret key will be stored in a secure cookie.
I'm planning an update that will not require the use of cookies soon.

[BayBreezy]

ok @huy97

I got it to work while testing out a new project.

I think it would be a great addition if we didn't have to set credentials to include
I say this because an api that is collecting data from all over the place can possible add all the origins to the cors configuration.
BUT they may still want to get rid of bots submitting forms lolol. Ran into a problem recently where the api's register endpoint was being abused. This module would have helped greatly.

Thanks for the good work. Appreciate it