Skip to main content
5,442 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

I'm using the github.com/utrack/gin-csrf package to implement CSRF protection in my web application and using. I'm observing an unexpected pattern using the simple go application in their repo. Step 1 ...
Rodrigo Silveira's user avatar
  • 157
1 vote
2 answers
75 views

Problem I am struggling with annoying 419 error trying to logout. The login and register are working fine. My api and spa are on the same top-level domain, but different ports api - localhost:8000 spa ...
Dmytro Shved's user avatar
  • 123
Best practices
1 vote
4 replies
85 views

Good day peeps, What's the purpose of having both a JWT and CSRF token stored in cookies? If a malicious actor steals/performs a replay attack, they will be authorized and receive the same data as the ...
Abrie's user avatar
  • 3
1 vote
1 answer
70 views

I'm encountering a persistent 403 Forbidden error with the detail: CSRF Failed: CSRF token missing. This happens when trying to obtain an authentication token using Django REST Framework's built-in ...
mohsen's user avatar
  • 11
0 votes
1 answer
76 views

I use OCaml/Dream to create a simple HTML form (No sensitive data at all). let form_page request = let _csrf_token = Dream.csrf_token request in Dream.html (Printf.sprintf {| <form action="/...
Abdelghani's user avatar
  • 789
0 votes
1 answer
66 views

Firstly, the OAuth flow, itself, works. After sign / login I create a session using gorilla/sessions and set the session cookie. Now, since I use cookies as the auth mechanism, I thought it followed ...
Biobele Johnbull's user avatar
  • 39
0 votes
0 answers
87 views

I'm facing an issue with my application which is allowing the user to change the X-XSRF-TOKEN and it's being validated in the backend. For the context: I'm using Spring Boot 2.7.7 and Spring Security ...
Dan's user avatar
  • 1,585
1 vote
0 answers
52 views

We upgraded our spring boot application from 2.5.14 to 3.5.5, now POST requests for multipart file upload are failing with a 403 response. This is a service to service interface, no user login is ...
Fredo's user avatar
  • 159
1 vote
1 answer
65 views

Let's consider that I have a stateless service with an authentication mechanism that makes the browser automatically send the credentials which then makes even a stateless service vulnerable. I want ...
Display name's user avatar
  • 131
0 votes
0 answers
55 views

I was getting Missing CSRF Vulnerability in codeQL to fix that i implemented it , i am using both session base and auth base (Jwt) STEP 1 - Installed Lusca and Enabled Sessions (CSRF needs them) - npm ...
user0999's user avatar
  • 23
0 votes
0 answers
23 views

We have react front end running as a web app in Azure We have a DRF backend running in a container in Azure. We are using cookies for authentication. We have a postgres database on the backend. We are ...
braddo's user avatar
  • 71
0 votes
0 answers
128 views

I'm trying to validate the CSRF token but it's not working, it's giving me "403 forbidden: invalid CSRF token" I disabled the double-CSRF protection and put some logs in my code and I've ...
Pedro Rodrigues's user avatar
  • 15
1 vote
1 answer
616 views

I am building a FastAPI app serving Jinja2 templates and am a bit unsure on how to handle CSRF tokens. I have added Starlette's SessionMiddleware: app.add_middleware(SessionMiddleware, secret_key=&...
sobmortin's user avatar
  • 65
1 vote
0 answers
19 views

I am attempting to connect to the QuickBooks Online (QBO) API and when I try to connect I get this error in the browser: The state query parameter is missing from the authorization request And then ...
Julia Sawin's user avatar
  • 11
0 votes
3 answers
147 views

There is a web page which does not use any cookies: <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <script> async function ...
Derick's user avatar
  • 1
0 votes
2 answers
130 views

I use Laravel Sanctum to authorize SPA application requests (NuxtJS). In general, I understood the idea with the /sanctum/csrf-cookie endpoint and am already sending a request using axios, which ...
jsssy's user avatar
  • 1
1 vote
0 answers
81 views

Can someone explain me how to use in form and how to pass data to route with simple example... <form> {{ csrf.form_tag }} </form>
user29559775's user avatar
  • 39
0 votes
1 answer
50 views

working on a laravel project, Cookie and session stopped setting on client's browser in production but work on localhost. every form submission is not getting to controller and returned 419 page ...
Abenslive's user avatar
  • 83
0 votes
2 answers
526 views

I am new to webdevelopment and have written some tests in Playwright to test my webapplication. The tests are failing only on Webkit/safari, seemingly due to CSRF validation issues returning 403 ...
C.H.'s user avatar
  • 13
0 votes
0 answers
69 views

Is it enough to prevent CSRF by rejecting x-www-form-urlencoded, using SameSite=Strict cookies, and making GET requests read-only? I'm trying to make sure my web application is fully protected ...
Dmytro Kozak's user avatar
  • 1
1 vote
1 answer
87 views

I am using Laravel. When adding enctype="multipart/form-data" in form it give CSRF error and when removing form submitting fine. My php.ini file settings are: max_execution_time=3600 ...
Ovais Jetnetix's user avatar
  • 33
0 votes
1 answer
73 views

I am encountering a CSRF token error when submitting a form with file uploads using multer in an Express.js application. I am using enctype="multipart/form-data" to handle the file input, ...
Sardorbek Shodmonov's user avatar
  • 1
0 votes
0 answers
59 views

I'm developing an app with an Express backend protected by CSRF using the csrf-csrf package (Double Submit Cookie Pattern) and a Next.js frontend (using App Router and server actions). My refresh ...
Galavu's user avatar
  • 21
0 votes
1 answer
116 views

I stuck on an issue in my Spring boot microservice application using Spring cloud gateway. I have a microservice for authentication base on Keycloak exposing some api like register, login and so on. ...
ousmane MBINTE's user avatar
  • 17
0 votes
1 answer
158 views

Problem I'm building an application with a Next.js frontend and Laravel backend using Sanctum for SPA authentication. When I login from the Next.js app, I can see the authentication cookies being set ...
Marko Ticinovic's user avatar
  • 1
0 votes
0 answers
57 views

I have a python/django web API with a single endpoint, let's call it /api/v1/form. That API is called from a Flutter-web frontend application. I currently use the following configuration that disables ...
SpaceBurger's user avatar
  • 549
1 vote
0 answers
45 views

It's unclear to me how PKCE will fundamentally protect against CSRF attacks. If I'm logged in as an authorized user, and click a malicious link to "change the state" of my application, how ...
user29988412's user avatar
  • 11
0 votes
0 answers
48 views

I am using Java Spring WebFlux and I want to implement CSRF security. I am curious what the best practises are nowadays, seeing so many different answers. I'm especially interested in checking if it's ...
J. Doe's user avatar
  • 13.5k
0 votes
0 answers
65 views

About my architecture: I have a backend with Express.js and a frontend with Next.js. I have massive problems with my CSRF cookie. I create it in Express.js and send it to Next.js (Client). Here it is ...
Hannes's user avatar
  • 11
0 votes
0 answers
31 views

Local Development Environment. I have touched a little the template file with which the nginx configurations are generated, the result is the following: # from nginxproxy/nginx-proxy # uknp.dock/ ...
Francisco IA Lover's user avatar
  • 101
0 votes
1 answer
95 views

I have my logins and logout working....what I don't understand is how having the CSRF in the cookie being "secure".... I guess I'm mising the punchline as how this is secure as both are in ...
BostonAreaHuman's user avatar
  • 1,489
0 votes
0 answers
76 views

I am very new to using Django-laugh, and I want to integrate it with my Django backend. I was trying to use the react-spa example outlined in the docs https://react.demo.allauth.org/, but I got a 401 ...
Adrian Ronquillo's user avatar
  • 1
1 vote
1 answer
105 views

I am using inline JQuery to POST to a url on my site so that I can include a CSRF token via a PHP variable. I've been trying to find an answer but can't seem to find it, I just keep finding questions ...
Sean Doe's user avatar
  • 11
1 vote
0 answers
34 views

So I am developing a small auth-module for an application of mine, mainly to learn how session based auth really works. I thought it would be cool if it could also provide csrf protection, so I kinda ...
nox's user avatar
  • 11
0 votes
0 answers
235 views

I've just read this article about Flask and using Svelte frontend with a separate API specifically the section calledFrontend Served Separately (cross-domain) They are creating a CSRF cookie and ...
Johnny John Boy's user avatar
  • 3,326
0 votes
0 answers
40 views

Context (Double Submit Cookie and Subdomains): When using a CSRF token with a cookie for the Double Submit Cookie method, you have to ensure the client receiving the cookie can read this cookie, and ...
Nik's user avatar
  • 1
0 votes
1 answer
181 views

I am using reactive Spring Boot 3.4.3 with webflux. For easier setup, CSRF has been disabled .csrf(ServerHttpSecurity.CsrfSpec::disable). Then I turn it on in this way (because of expected integration ...
banterCZ's user avatar
  • 1,902
1 vote
1 answer
51 views

In my app, I use the nuxt-csurf module. Meaning, I have to use useCsrfFetch and $csrfFetch. This works fine during manual testing, but in Vitest I need to mock these functions. I have tried: vi.mock('....
L1nux's user avatar
  • 21
0 votes
0 answers
68 views

I have a flask app based on the tutorial here https://flask.palletsprojects.com/en/stable/tutorial/. The tutorial comes with a test suite but having adapted the app to use WTForms the tests that post ...
jaybee's user avatar
  • 1,959
0 votes
0 answers
20 views

My frontend is on a different domain than the WebSSH server (running on the Tornado framework), and Im encountering an issue with the XSRF token. Since the XSRF token is not delivered through a ...
Eng. Kai's user avatar
  • 23
0 votes
0 answers
82 views

I'm having an issue with doubleCsrf in my Express.js backend, and I keep getting the following error on every request: ForbiddenError: invalid csrf token at doubleCsrf (file:///Users/admin/...
FunnyDEV's user avatar
  • 29
2 votes
0 answers
99 views

I have a Django application (A), and one of my clients wants to embed it within their application (B) using an iframe. The client application can be built with any framework, and we have no control ...
Sidharth Chandra's user avatar
  • 31
0 votes
0 answers
82 views

I have an application running with react as the frontend and django (with all-auth) as the backend. When I use an online hosting service, I get the following issues: TypeError: NetworkError when ...
Joshua Singla's user avatar
  • 71
1 vote
0 answers
31 views

I'm making an app where students can login to there portal website and it shows their data, however I'm having trouble authenticated users, when I did this project on another website I used ...
abtlb's user avatar
  • 11
0 votes
1 answer
299 views

I've been programming a Django application for over a year now. I got the CSRF token working fine in the beginning and there haven't been any problems since. But now, it's suddenly stopped working, ...
Alex Enersen's user avatar
  • 3
0 votes
0 answers
61 views

I have a DLink DWR-921 router that works with mobile internet. It has an admin page http://ipaddress/sys_smsmsg.htm that allows to send sms via the SIM card that feeds the router. I am trying to ...
VikSil's user avatar
  • 108
0 votes
0 answers
40 views

I am developing a React app with Django REST Framework as backend and hosting both on Heroku. When registering or logging in via the frontend, I get a 404 Not Found error for the CSRF token endpoint: ...
ChrisCross83's user avatar
  • 1
0 votes
0 answers
46 views

I am working on translating a page from Codeigniter 3 to Codeigniter 4, and have session based CSRF protection enabled in CI4. For some reason, even though I can see the CSRF name and CSRF hash in ...
xanabobana's user avatar
  • 87
0 votes
0 answers
21 views

I am using an application factory and running into trouble excluding some routes from csrf_token. The csrf exexmpt works for the entire crud_bp. But how would I exclude only certain routes. I have ...
newdeveloper's user avatar
  • 718
0 votes
0 answers
49 views

I have a Nodejs app with React in front. I implemented my csrf like: // initial-csrf.js var csrf = require("csurf"); const csrfProtection = csrf({}); module.exports = { csrfProtection, };...
Tjax's user avatar
  • 333

1
2 3 4 5
…
109