CODEWITHSUNDEEP
javascriptajaxcross-domainsails.jscsrf
derzunov
derzunov

Reputation: 452

I Get 403 CSRF Mismatch when I'm trying to send the "post" request to SailsJS server

I have a sailsJS server. I try to send post request from client on another domain.

I send _csrf from /csrfToken, but I'm getting 403 csrf mismatch again and again

The client code looks like this:

    $.ajax({
                  url: 'http://myserverdomain.ru/csrfToken'
                  success: (response) ->
                      $.ajax({
                          url: 'http://myserverdomain.ru/session/create'
                          type: "POST"
                          crossDomain: true
                          xhrFields: {
                              withCredentials: true
                          }
                          data: {_csrf: response._csrf, email: 'mail@mail', password: 'password'}
                          error: () ->
                              console.log 'error'
                          success: ( resp ) ->
                              console.log resp
                      })
            })

configs of the server:

module.exports.csrf = {
    grantTokenViaAjax: true,
    origin: 'http://myclientdomain.ru'
};


module.exports.cors = {

  allRoutes: true,

  origin: 'http://myclientdomain.ru',

  credentials: true,

  methods: 'GET, POST, PUT, DELETE',

  headers: 'content-type'

response looks like this:

CSRF mismatch

general:

Remote Address:ip.ip.ip.1:1010
Request URL:http://myserverdomain.ru/session/create
Request Method:POST
Status Code:403 Forbidden

requested headers:

Accept:*/*
Accept-Encoding:gzip, deflate
Accept-Language:ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4
Content-Length:95
Content-Type:application/x-www-form-urlencoded; charset=UTF-8
Cookie:sails.sid=s%3A_HBoGJvI9N_-kH3Bj2LBrIrayWAb_k4z.N9P%2F%2Bt%2FDWCFAuK1MvBNjyYO1ntmp5m8a5Te0IM%2Ftn7s; BCSI-CS-c82c2a7dcc10e8b5=2
Host:myserverdomain.ru
Origin:http://myserverdomain.ru
Proxy-Connection:keep-alive
Referer:http://myserverdomain.ru/
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36

form data:

_csrf:ljGDMpSr-_O1ktMJ-zHEJfWaKPygXwNSSjcU
email:mail@mail
password:password

Help me, please!

Upvotes: 3

Views: 2297

Answers (3)

Dom
Dom

Reputation: 1

In the config/crfs.js, add these lines and your route:

module.exports.csrf = {
  grantTokenViaAjax: true
  , routesDisabled: '*Route URLs*',
  'origin': '*'
}

Upvotes: 0

Z T
Z T

Reputation: 570

You have to send it in the header

Add X-CSRF-Token:

$.ajax({
url: 'http://myserverdomain.ru/csrfToken'
success: (response) ->
  $.ajax({
      url: 'http://myserverdomain.ru/session/create'
      type: "POST"
      crossDomain: true
      beforeSend: function(xhr, settings){
          xhr.setRequestHeader('X-CSRF-Token', '_PUT_YOUR_CSRF_HERE_');
      }
      xhrFields: {
          withCredentials: true
      }
      data: {_csrf: response._csrf, email: 'mail@mail', password: 'password'}
      error: () ->
          console.log 'error'
      success: ( resp ) ->
          console.log resp
  })
})

Upvotes: 1

kiran
kiran

Reputation: 384

I am not familiar with SailsJs, but after spending few minutes on their Documentation, what you are doing seems correct, but I would try couple of things

  1. Try setting _csrf in the header.
  2. Change the origin in the module.exports.csrf to * module.exports.csrf = { grantTokenViaAjax: true, origin: '*' }

Upvotes: 1

Related Questions