Stack Overflow
Stack Overflow

Questions tagged [csrf-token]

Use this tag for questions related to csrf (Cross-site request forgery) that involves the generation of a token.

A csrf-token is a secret value added to a web form by the server and sent back by the user as part of a POST request, used to prevent cross-site request forgeries by making sure that the user sending the POST request has actually loaded the form.

466 questions
60
votes
2 answers

Difference between CSRF and X-CSRF-Token

What is the difference between use X-CSRF-Token in an HTTP header or token in the hidden field? When to use the hidden field and when to use the header and why? I think that X-CSRF-Token is when I'm using JavaScript / AJAX but I'm not sure.
monkeyUser
  • 4,301
  • 7
  • 46
  • 95
23
votes
5 answers

I can't log in to Instagram: "CSRF token missing or incorrect"

I was using Selenium Python to log in to Instagram and open some pages. It worked fine, but after two days the Instagram started sending the message "CSRF token missing or incorrect". And now I can't even log in with my script or manually to any…
Eoaneh
  • 339
  • 1
  • 1
  • 5
18
votes
1 answer

protect_from_forgery in Rails 6?

The protect_from_forgery method isn't included in my application controller with a default Rails 6 app, but there's the embedded ruby <%= csrf_meta_tags %> in the main application layout. Does this mean that the protect_from_forgery method has been…
greenie-beans
  • 440
  • 1
  • 5
  • 15
17
votes
5 answers

django no csrftoken in cookie

I'm testing to make a POST ajax request and I got a 403 because of no csrftoken. I followed the Document, however, it still doesn't work and I found that the cookie named csrftoken is empty, it means $.cookie("csrftoken") return null. Can someone…
David Qin
  • 355
  • 1
  • 3
  • 8
14
votes
2 answers

Session cookie set `SameSite=None; Secure;` does not work

I added SameSite=None; Secure; to set-cookie. but the cookie was not set and I can’t log in to my site. response.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': 'token=' + token + '; SameSite=None; Secure; Expires=' +…
mrbelane
  • 175
  • 1
  • 1
  • 7
10
votes
5 answers

Laravel + Vue.js (axios) - CSRF token mismatch

I have problem with csrf token in Laravel. Sometimes request POST (via axios) returns 419 code "CSRF token mismatch" but request header contain CSRF and XSRF tokens. Interestingly, it's not happend in incognito mode. App.blade:
serpentow
  • 186
  • 1
  • 1
  • 8
9
votes
3 answers

Django: How to send csrf_token with Ajax

I have my Ajax in a jQuery function: btnApplyConfig.js: $(".btnApplyConfig").click(function(){ var token = $("input[name=csrfmiddlewaretoken]").val(); // Some other vars I'm sending properly console.log('token: '+token); //printing…
Gonzalo Dambra
  • 891
  • 2
  • 19
  • 34
8
votes
3 answers

CSRF Failed: Origin checking failed - http://localhost:8000/ does not match any trusted origins

Please help me solve the problem. I was building an app consisting of Django Rest Framework and ReactJS. I used ViewSets. my error: response data: {"detail":"CSRF Failed: Origin checking failed - http://localhost:8000/ does not match any trusted…
nOybek
  • 305
  • 1
  • 4
  • 7
6
votes
3 answers

Next-Auth Credentials Provider with Laravel - Request failed with status code 419

I have a NextJS Frontend with Next-Auth installed and a Laravel Backend using Sanctum When I try to login using the signIn function of Next-Auth, it gives me this error: Request failed with status code 419 419 has to do with CSRF token but I am…
Arjun
  • 199
  • 2
  • 12
6
votes
5 answers

Dockerize pgAdmin - The CSRF tokens do not match

I've been trying to fix an issue which is when I try to login to pgAdmin (in docker container) behind Nginx Proxy I'm getting an error that The CSRF tokens do not match. See https://en.wikipedia.org/wiki/Cross-site_request_forgery Frankly, the…
user3073480
  • 81
  • 1
  • 4
6
votes
2 answers

How to add csrf to flask app without wtforms?

I have a simple web app, And I want to add csrf protection. But I didn’t understand the csrf wrapper provided by Flask-WTF. I've already seen the docs. But still didn’t understand how it works. My questions is: (1) After wrapping the app, Do I need…
Mr. lindroid
  • 162
  • 1
  • 12
6
votes
3 answers

csrf_token() is empty in l5-swagger and couldn't do any request except GET request

csrf_token() is empty in l5-swagger and couldn't do any request except GET because the header is missing and always getting 419 error code I have tried to request it from postman and it works. but in swagger it didn't. I have taken a look from this…
Cheezey
  • 500
  • 5
  • 15
6
votes
9 answers

laravel 5.7.15 419 Sorry, your session has expired. Please refresh and try again

Hello i am using laravel 5.7.15 i am facing issue
Ijaz Ahmed Bhatti
  • 736
  • 1
  • 7
  • 26
6
votes
1 answer

Where is the csrftoken stored in Django database?

Where is the csrftoken stored? When I access an API endpoint (logout API, it do not need the params): POST /rest-auth/logout/ HTTP/1.1 Host: 10.10.10.105:8001 Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, */* Origin:…
user7693832
  • 6,119
  • 19
  • 63
  • 114
5
votes
1 answer

CsrfFilter always fires exception in Spring 6.0+

In the new Spring Boot 3.0.1 I'm adding support for CSRF protection by adding this simple configuration as per Spring documentation: http.csrf().csrfTokenRepository(tokenRepository); and @Bean public CsrfTokenRepository tokenRepository() { …
user3411289
  • 177
  • 1
  • 1
  • 6
1
2 3
…
30 31