How to send csrf token in AJAX request (Without Jquery) in expressjs?

Question

I am using the csurf module in expressjs. It works for all post requests as I use it the following way.

app.use(csrf());
res.locals.csrfToken = req.csrfToken();

This way its automatically available in all forms where I have the following.

<input type="hidden" name="_csrf" value="<%=csrfToken%>">

but how do I set the csrftoken on AJAX requests, I am not using jquery, below is the JS function to send AJAX request. I do have the csrf token available on the html as a hidden value that I have access via getElementByID.

note: I am able to send the request if I disable csrf.

function voteQuestion () {
    var qid = document.getElementById("qid").value;
    var csrf = document.getElementById("csrf").value;
    var http = new XMLHttpRequest();
    var url = "/q/ajaxcall";
    var params = "qid="+ qid;
    http.open("POST", url);
    http.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
    http.onreadystatechange = function() {
    if(http.readyState == XMLHttpRequest.DONE && http.status == 200) {
         var json = (http.responseText);
         var obj = JSON.parse(json);

         document.getElementById("vote-sp").innerHTML = (obj.upvotes);
    }
};
http.send(params);

}

You can use FormData() object to send a full form data with CsrfToken. — Ataur Rahman Munna
– Ataur Rahman Munna, Commented Jan 3, 2017 at 5:23

user856984 · Accepted Answer · 2017-01-03 16:45:30Z

1

I have been trying to figure this out for almost a week now, and just decided to console.log req.session and found cookies contains "XSRF-TOKEN" value, so in the AJAX request header I set XSRF-TOKEN to csrf and now it works, I dont know why it works this way particularly for AJAX requests.

setRequestHeader("XSRF-TOKEN", csrf);

answered Jan 3, 2017 at 16:45

user856984

1251 gold badge3 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Hikmat Sijapati · Accepted Answer · 2017-01-03 05:18:41Z

0

Set crsf token in your params as below..

var params = "qid="+ qid + "&crsf="+csrf;

OR

You can create a new object for sending data as below..

var data = {};   //crates new object
data.qid = qis;  //adds qid to object
data.csrf = csrf; //adds qid to object

params = data;   // to server

answered Jan 3, 2017 at 5:18

Hikmat Sijapati

6,9691 gold badge12 silver badges19 bronze badges

3 Comments

user856984 Over a year ago

tried both, still get ForbiddenError: invalid csrf token. I also tried "&_csrf" since csurf uses that as it's name value, still does not work. plus tried setRequestHeader('X-CSRF-Token', csrf), this also does not work.

Hikmat Sijapati Over a year ago

check value in server file using $_POST['csrf'];

user856984 Over a year ago

I cannot send the request , so I cannot check it. I am using express and have a console.log on my router.post("/q/ajaxcall") and the request does not even get until that point.

Collectives™ on Stack Overflow

How to send csrf token in AJAX request (Without Jquery) in expressjs?

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related