Open ghost opened 8 years ago
Hi I guess you cannot actually validate that, but the handler will only be called if the csrf is present and is ok. See: https://github.com/krakenjs/lusca/blob/master/lib/csrf.js#L80.
However I guess you can use req.csrfToken()
to issue a new one and verify everything is ok (See https://github.com/krakenjs/lusca/blob/master/lib/csrf.js#L60).
Regarding the CSP problem, It would be helpful to get the actual request from your chrome network inspector. Also seems like the "notify" url is not the same as the referenced from the CSP configuration (/r vs /report)
Hope this helps.
I am trying to build a basic Express app with some security protocols implemented using Lusca.
I am facing two issues. The first is with CSP (content security policy), for some reason when a violation is caught the browser doesn't carry out
report-uri http://localhost:3000/r
, and the network monitor gives a canceled status. Can someone explain the problem here?The second issue is with CSRF (cross-site request forgery), I keep getting an
CSRF token missing
error when I submit the form, I cannot tell why. How can I avoid having this error displayed and how can I validate the token itself? with sessions?I have followed the docs very carefully, but with no luck. Here is my code: