Facing "Missing or incorrect CSRF cookie type" Error During User Login

[4quarks]

Description

I tried to install cerebrate on fresh VMs (Ubuntu 20.04 and 22.04) using both apache2 and ngix and I am encountering a "Missing or incorrect CSRF cookie type" error when attempting to log in to the application. The issue arises when navigating to '/users/login?redirect=%2F', resulting in the application failing to find the requested address and throwing a CSRF token validation error.

Steps to Reproduce

1. Install cerebrate following the instructions
2. Navigate to the login page at '/users/login'.
3. Enter login credentials and submit the form.
4. Encounter the "Missing or incorrect CSRF cookie type" error.

Expected Behavior

The login should be successful, and the user should be redirected to the specified redirect URL without encountering CSRF token errors.

Actual Behavior

The login process is interrupted by a `Missing or incorrect CSRF cookie type." error.

Environment

• CakePHP: 4.5.4
• PHP: 8.2.16
• mysql 15.1: 10.3.39-MariaDB
• ngix: 1.18.0
• Firefox: 123.0.1
• OS: Ubuntu 20.04

Log Output

/var/www/cerebrate/logs/error.log

2024-03-11 09:41:09 error: [Cake\Http\Exception\InvalidCsrfTokenException] Missing or incorrect CSRF cookie type. in /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php on line 392
Stack Trace:
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php:172
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Runner.php:82
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Runner.php:67
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Routing/Middleware/RoutingMiddleware.php:198
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Runner.php:82
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Routing/Middleware/AssetMiddleware.php:68
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Runner.php:82
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Error/Middleware/ErrorHandlerMiddleware.php:149
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Runner.php:82
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Runner.php:67
- /var/www/cerebrate/vendor/cakephp/cakephp/src/Http/Server.php:99
- /var/www/cerebrate/webroot/index.php:40
- [main]:

Request URL: /users/login?redirect=%2F
Referer URL: http://mydomain:8000/users/login?redirect=%2F

Additional Context

• The issue occurs consistently when trying to log in, and it appears to be related to CSRF token handling.
• I have already tried clearing the browser cookies and cache, as well as verifying the session configuration and CSRF middleware settings.

Attempts to Resolve

• I have tried to use different OS versions (Ubuntu 20.04 and 22.04).
• I have tried to use both ngix and apache2.
• I have cleared browser cookies and cache.
• I have verified that the session configuration in CakePHP is correctly set.
• I have checked and ensured that the CSRF middleware is properly configured and included in the middleware stack.

I am looking for guidance on how to resolve this issue and would appreciate any advice or suggestions. Thank you in advance.

[iglocska]

Is the baseurl set up correctly? I cannot reproduce it, but something that may give a hint is that the CSRF tokens are generated by a mixture of the baseurl, current time, the fields in the form, the target URL and a random value.

[Wachizungu]

This was doing my head in as well... xD

changing the following 2 settings solved it for me (obviously only for dev instance): set session.cookie_secure in config/bootstrap.php to false set secure in registerMiddleware('csrf' part of config/routes.php to false

Guessing that using a self-signed cert would solve this as well :) and perhaps would be a better option