Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid CSRF - Case creation form #240

Open
HeitorMatt opened this issue Sep 11, 2020 · 1 comment
Open

Invalid CSRF - Case creation form #240

HeitorMatt opened this issue Sep 11, 2020 · 1 comment
Assignees
Labels
bug Something isn't working help wanted Extra attention is needed high priority Needs to be resolved ASAP production harena in the cloud

Comments

@HeitorMatt
Copy link
Member

HeitorMatt commented Sep 11, 2020

When attempting to create a case (using axios and form), it results in Invalid CSRF. The error started to occur after 'token-validator.js'. The validator makes one GET request using axios, and somehow that's messing up the CSRF for the case creation POST. Need help to figure this out.

Ps. The error only occurs in the production (https://harena.ds4h.org/create). I've temporarily disabled the CSRF in 'config/shield.js', just so Marco can keep using the platform with no error.

@HeitorMatt HeitorMatt added bug Something isn't working help wanted Extra attention is needed production harena in the cloud high priority Needs to be resolved ASAP labels Sep 11, 2020
@lealfp
Copy link
Member

lealfp commented Sep 15, 2020

I think that CSRF problems would be magically solved if we merge space and manager in a monolithic app. Or, maybe we could give up of adonis and try a framework better suited to distributed systems as we discussed on last meeting.

We need to make a decision at this point, in order to guarantee CSRF protection on Minho/AWS environments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working help wanted Extra attention is needed high priority Needs to be resolved ASAP production harena in the cloud
Projects
None yet
Development

No branches or pull requests

5 participants