Closed erbridge closed 7 years ago
The secret is saved in the session. Any chance of a new session or sid is lost?
That was indeed the issue. I had failed to set app.set('trust proxy', 1)
.
Thanks for the pointer.
I have similar problem. Over 60% of the time lusca CSRF works every time, but it's still annoying. Setup is express 4.*, nginx proxy, ssl.
app.enable('trust proxy', 1)
app.set('trust proxy', 'loopback, linklocal, uniquelocal')
app.use(flash());
app.use(session({
key: 'sid',
resave: true,
saveUninitialized: true,
secret: process.env.SESSION_SECRET,
cookie: { maxAge: 60000, secure: true},
store: new MongoStore({
url: process.env.MONGODB_URI || process.env.MONGOLAB_URI,
autoReconnect: true,
clear_interval: 3600
})
}));
app.use(lusca.csrf({ secret: 'qwerty' }));
app.use(lusca.xframe('SAMEORIGIN'));
app.use(lusca.xssProtection(true));
app.use(lusca.hsts({
maxAge: 31536000,
includeSubDomains: true,
preload: true,
}));
What could be the case?
I'm having trouble getting CSRF working with HTTPS on AWS. I have it working fine locally, using a self-signed SSL certificate, but on the staging server behind a load balancer, I get
Error: CSRF token mismatch
. I am using Express, and Lusca is set up as below._csrf
is being sent in the POST body.Any idea what's going wrong?