@pitaj No, outside iframe everything is working.
Tested with and without *, also tried to write direct values / domains into fields. Each time the same result.
Also it looks that csrf token is sending in login request.
I suspect that problematic could be cookies, but can't find direct reason. That's why I'm asking for help.
@pitaj In test environment I'm using two addresses:
Below headers settings:
I would like to ask for help in case of receiving "invalid csrf token" exception during user login when NodeBB is used from iframe.
I added headers in Settings -> Advanced -> Headers
Request for /login throws 403 Forbidden and in the logs I'm receiving /login invalid csrf token
Could you give me a hint what I could additionally check / in what place I could search possible problem? Just let me know if I could add more detailed information / logs. Thanks!
@baris Probably I got the problem (or rather problems).
Homepage for my forum is set to custom page based on plugin:
https://github.com/NodeBB-Community/nodebb-plugin-custom-pages
Sadly it looks that it's missing applying csrf token, so in the situation when custom page is loaded first - each next loaded dynamically (without page refresh) will be without csrf token (until user refresh forum on other page, like topic or categories).
It could be easier to catch, but in my case there was also that my file upload was in the custom plugin with own route. And I was creating it like:
router.get('/groups/:slug/lesson/:lessonId/:name', middleware.buildHeader, lessonController.render);
router.get('/api/groups/:slug/lesson/:lessonId/:name', lessonController.render);
instead of using helper:
const routesHelpers = require.main.require('./src/routes/helpers');
routesHelpers.setupPageRoute(app, '/groups/:slug/lesson/:lessonId/:name', middleware, [], lessonController.render);
It would be great if you can confirm that nodebb-plugin-custom-pages really could make the trouble, thanks!
After update NodeBB to version 1.14.2 I have problems with the missing csrf_token in the client js scripts. It's used for ajax submits when uploading a files: 'x-csrf-token': config.csrf_token. Token is set in apiController.loadConfig.
The problem is related to the merge made by @barisusakli https://github.com/NodeBB/NodeBB/pull/8367/commits
For some reason added middleware.applyCSRF is not worked as it should be and csrf token is not applied to the config (missing in the req).
After revert the code to the state before this changes - it's working.
I don't know if this is a bug or just a situation related to my forum/nginx (test env)/apache (prod env) configuration.
Can I ask about help to solve this issue? Let me know if I can provide any additional logs/details related to the case. Thanks!
Hi, I want to report that I have the same error as the author of this topic. I just have started maintencance of NodeBB forum and I wanted to upgrade it to the newest version. I did every step from upgrade guide, but unfortunatelly error occurs when I was trying to update forum with "upgrade" command.
When I was searching solution to my problem I found this commit https://github.com/NodeBB/NodeBB/commit/6f1fb4eb246f035c329ff361ed2cf145e3936335 and this topic https://github.com/barisusakli/nodebb-plugin-dbsearch/issues/49
So everything pointed to added line "require('../../require-main');" as the cause of the problem (in file src/cli/index.js). I moved it to upgrade.js file, before the upgradePlugins require and everything works.