Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CSRF token expiry results in unresponsive form. #333

Open
CharString opened this issue Dec 22, 2022 · 0 comments
Open

CSRF token expiry results in unresponsive form. #333

CharString opened this issue Dec 22, 2022 · 0 comments
Labels
bug Something isn't working prio: low

Comments

@CharString
Copy link
Contributor

CharString commented Dec 22, 2022

As an anonymous Submitter
When I let my Session expire
And I click here
image
And for some reason (time/server things) my CSRF token has become invalid
I do get the first login step
image
But clicking "Start formulier" does not start the submission, nor gives me feedback.

Analysis:
Backend correctly reponds with a 403 the POST:

{
	"type": "http://127.0.0.1:8000/fouten/PermissionDenied/",
	"code": "permission_denied",
	"title": "You do not have permission to perform this action.",
	"status": 403,
	"detail": "CSRF Failed: CSRF token missing or incorrect.",
	"instance": "urn:uuid:45c5dc8b-8240-4f3f-8553-94de91c5e995"
}

because the POST request contained these headers

Cookie: csrftoken=TrPftlIryvbjBGq63oh3Y7CnT0oVVUeeiPGOOS6hYOfND7lvJzQhfY7L3rMIYBkA; cookie_consent="analytical=2021-07-19T12:11:35.633000+00:00"; openforms_language=en; openforms_sessionid=lm1kgzn4k0sck8u8lof0osahlma4tcb1
X-CSRFToken: ksJHbv1k39EhazO9jROF6ZTbyMlPcTE2ss6yMNI6VsVbD7UuXAJJ2flUTMmFO7zu

and these tokens are not the same.

A refresh of the page resolves the issue.

Probably not related to open-formulieren/open-forms#2291

@joeribekker joeribekker added bug Something isn't working prio: low labels Feb 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working prio: low
Projects
None yet
Development

No branches or pull requests

2 participants