{"action":"created","issue":{"url":"https://api.github.com/repos/jedireza/drywall/issues/323","repository_url":"https://api.github.com/repos/jedireza/drywall","labels_url":"https://api.github.com/repos/jedireza/drywall/issues/323/labels{/name}","comments_url":"https://api.github.com/repos/jedireza/drywall/issues/323/comments","events_url":"https://api.github.com/repos/jedireza/drywall/issues/323/events","html_url":"https://github.com/jedireza/drywall/issues/323","id":112427287,"number":323,"title":"csrf issue","user":{"login":"Jonasyao","id":2032572,"avatar_url":"https://avatars.githubusercontent.com/u/2032572?v=3","gravatar_id":"","url":"https://api.github.com/users/Jonasyao","html_url":"https://github.com/Jonasyao","followers_url":"https://api.github.com/users/Jonasyao/followers","following_url":"https://api.github.com/users/Jonasyao/following{/other_user}","gists_url":"https://api.github.com/users/Jonasyao/gists{/gist_id}","starred_url":"https://api.github.com/users/Jonasyao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jonasyao/subscriptions","organizations_url":"https://api.github.com/users/Jonasyao/orgs","repos_url":"https://api.github.com/users/Jonasyao/repos","events_url":"https://api.github.com/users/Jonasyao/events{/privacy}","received_events_url":"https://api.github.com/users/Jonasyao/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/jedireza/drywall/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-20T18:13:41Z","updated_at":"2016-02-03T13:43:57Z","closed_at":"2015-10-21T06:19:30Z","body":"Hi,\r\n\r\nI have experienced some CSRF issues.\r\n\r\nOnce I add a group of js lib into the default.jade file in order to make a mobile menu work, there is a csrf issue comes out when I try to login to get to the account page.\r\n\r\n```\r\nscript(src=\"/layouts/js/jquery.js\")\r\nscript(src=\"/layouts/js/bootstrap.min.js\")\r\nscript(src=\"/layouts/js/jquery.easing.js\")\r\nscript(src=\"/layouts/js/jquery.flexslider-min.js\")\r\nscript(src=\"/layouts/js/jquery.nivo.slider.pack.js\")\r\nscript(src=\"/layouts/js/jquery.isotope.min.js\")\r\nscript(src=\"/layouts/js/jquery.mCustomScrollbar.concat.min.js\")\r\nscript(src=\"/layouts/js/jquery.prettyPhoto.js\")\r\nscript(src=\"/layouts/js/animate.js\")\r\nscript(src=\"/layouts/js/jquery.fitvids.js\")\r\nscript(src=\"/layouts/js/retina.js\")\r\nscript(src=\"/layouts/js/respond.min.js\")\r\nscript(src=\"/layouts/js/jquery.parallax-1.1.3.js\")\r\nscript(src=\"/layouts/js/jquery.refineslide.js\")\r\nscript(src=\"/layouts/js/selectnav.js\")\r\nscript(src=\"/layouts/js/functions.js\")\r\n```\r\n\r\n\r\n```\r\nForbiddenError: invalid csrf token\r\n        at verifytoken (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/csurf/index.js:269:11)\r\n        at csrf (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/csurf/index.js:97:7)\r\n        at Layer.handle [as handle_request] (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/layer.js:95:5)\r\n        at trim_prefix (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:312:13)\r\n        at /home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:280:7\r\n        at Function.process_params (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:330:12)\r\n        at next (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:271:10)\r\n        at SessionStrategy.strategy.pass (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/passport/lib/middleware/authenticate.js:318:9)\r\n        at SessionStrategy.authenticate (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/passport/lib/strategies/session.js:67:10)\r\n        at attempt (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/passport/lib/middleware/authenticate.js:341:16)\r\n        at authenticate (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/passport/lib/middleware/authenticate.js:342:7)\r\n        at Layer.handle [as handle_request] (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/layer.js:95:5)\r\n        at trim_prefix (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:312:13)\r\n        at /home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:280:7\r\n        at Function.process_params (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:330:12)\r\n        at next (/home/jyao/Desktop/XinViteerManagement/drywall/node_modules/express/lib/router/index.js:271:10)\r\n    POST /login/ 500 10.622 ms - 76\r\n```\r\n \r\nI really appreciate if there is any help on this."},"comment":{"url":"https://api.github.com/repos/jedireza/drywall/issues/comments/179240627","html_url":"https://github.com/jedireza/drywall/issues/323#issuecomment-179240627","issue_url":"https://api.github.com/repos/jedireza/drywall/issues/323","id":179240627,"user":{"login":"jedireza","id":979929,"avatar_url":"https://avatars.githubusercontent.com/u/979929?v=3","gravatar_id":"","url":"https://api.github.com/users/jedireza","html_url":"https://github.com/jedireza","followers_url":"https://api.github.com/users/jedireza/followers","following_url":"https://api.github.com/users/jedireza/following{/other_user}","gists_url":"https://api.github.com/users/jedireza/gists{/gist_id}","starred_url":"https://api.github.com/users/jedireza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jedireza/subscriptions","organizations_url":"https://api.github.com/users/jedireza/orgs","repos_url":"https://api.github.com/users/jedireza/repos","events_url":"https://api.github.com/users/jedireza/events{/privacy}","received_events_url":"https://api.github.com/users/jedireza/received_events","type":"User","site_admin":false},"created_at":"2016-02-03T13:43:57Z","updated_at":"2016-02-03T13:43:57Z","body":"@harshalbagul-cse please create new issues instead of posting on old closed ones. To help answer your question:\r\n\r\nThe csrf token is sent to the client via a cookie and then sent back to the server via request headers. We do this on the client side here:\r\n\r\nhttps://github.com/jedireza/drywall/blob/d6d6d7b1fb036f927a6cd3f5e6a1717683e50614/public/layouts/core.js#L16-L20\r\n\r\nWe're using the [`csurf`](https://github.com/expressjs/csurf) module for this. Please read the docs and study how we've implemented it and customize as needed."}}