{"action":"closed","issue":{"url":"https://api.github.com/repos/krakenjs/lusca/issues/97","repository_url":"https://api.github.com/repos/krakenjs/lusca","labels_url":"https://api.github.com/repos/krakenjs/lusca/issues/97/labels{/name}","comments_url":"https://api.github.com/repos/krakenjs/lusca/issues/97/comments","events_url":"https://api.github.com/repos/krakenjs/lusca/issues/97/events","html_url":"https://github.com/krakenjs/lusca/issues/97","id":188040758,"number":97,"title":"Error: CSRF token mismatch","user":{"login":"erbridge","id":1027364,"avatar_url":"https://avatars.githubusercontent.com/u/1027364?v=3","gravatar_id":"","url":"https://api.github.com/users/erbridge","html_url":"https://github.com/erbridge","followers_url":"https://api.github.com/users/erbridge/followers","following_url":"https://api.github.com/users/erbridge/following{/other_user}","gists_url":"https://api.github.com/users/erbridge/gists{/gist_id}","starred_url":"https://api.github.com/users/erbridge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erbridge/subscriptions","organizations_url":"https://api.github.com/users/erbridge/orgs","repos_url":"https://api.github.com/users/erbridge/repos","events_url":"https://api.github.com/users/erbridge/events{/privacy}","received_events_url":"https://api.github.com/users/erbridge/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-08T16:35:54Z","updated_at":"2016-11-08T17:09:22Z","closed_at":"2016-11-08T17:09:22Z","body":"I'm having trouble getting CSRF working with HTTPS on AWS. I have it working fine locally, using a self-signed SSL certificate, but on the staging server behind a load balancer, I get `Error: CSRF token mismatch`. I am using Express, and Lusca is set up as below. `_csrf` is being sent in the POST body.\r\n\r\n```js\r\napp.use(/^(?!.*\\/res\\/.*\\/upload).*$/, lusca({\r\n  csrf:   true,\r\n  xframe: 'DENY',\r\n  hsts:   {\r\n    maxAge:            31536000,\r\n    includeSubDomains: true,\r\n    preload:           true,\r\n  },\r\n  xssProtection: true,\r\n}));\r\n```\r\n\r\nAny idea what's going wrong?"}}
{"actor":{"display_login":"erbridge"}}