Invalid CSRF token

[riteshsanap]

Hello,
I m new to NodeBB, I just saw NodeBB and was instantly in love with it, I wanted to use it as a Backened forum. So I downloaded and started developing.

I duplicated a theme and renamed it , to start developing on it.
then I added this code in the library.js

function renderThemepage(req, res, next) {
	res.render('add_comic', {});
};

Theme.init = function(params, callback) {
	var app = params.router,
	middleware = params.middleware,
	controllers = params.controllers;
	 
	app.get('/comic/add', middleware.applyCSRF, middleware.buildHeader, renderThemepage);

	app.post('/comic/add', middleware.applyCSRF, middleware.buildHeader, function(req, res, next) {
		res.send(req);
	});
	callback();
};

add_comic.tpl has a basic form, that sends the post request to /comic/add but I get invalid csrf token in the logs whenever I submit the form.

[quinnsoft]

:)that sends the post request to /comic/add but I get invalid csrf token in the logs whenever I submit the form.

[julian]

You'll want to send in the csrf token as a header value. You can investigate time proper way to do so using jQuery.

The header name is x-csrf-token

[riteshsanap]

I checked using HTTP header plugin but no x-csrf-token is being passed, can you give an example or do you know any link where it is shown, I have duplicated vanilla theme as the base.

[riteshsanap]

Ok , I solved it, after checking that there is no csrf header i tried manually add it, but it didn't succeed I went add the token in template as (for those who might get stuck on same problem as me)

	<input type="hidden" value="{token}" name="_csrf" />

and passing the value like this

function renderThemepage(req, res, next) {
	var csrf = require('csurf');
	res.render('add_comic', {token: req.csrfToken()});
};

[julian]

@riteshsanap Good to know that still works.

Either pass in _csrf as a form value, or if submitting via ajax, can send x-csrf-token header

[mootzville]

I'm also getting an invalid csrf error while trying to log in if anyone can help me out...

I'm runnning 0.5.7 and reset theme and plugins, but not luck. I looked at mongodb and the sessions collection grows by about 6-9 documents each page request...weird. This is a development instance, so I'm the only one...

Also, I was logged in on Chrome and noticed I couldn't log in on Firefox...just Chrome for some reason. So, I cleared my cache in Chrome and it started giving me errors

[mootzville]

I figured out my issue...

MongoDB user I was using had a readWrite role, but I guess it needs the dbAdmin role as well. When I tried creating a new user in the nodebb admin area, then it would make things go wonky without the dbAdmin role and result in invalid csrf tokens.