Forbidden by CSRF on my registration form, not sure why
csrf, javascript, node.js
Solution
You should use bodyParser middleware, to let the server know that `_csrf` was passed.
Insert `app.use(express.bodyParser());` before `app.use(express.csrf());`.
Problem
I have setup CSRF on my `Express v3` app, and I have it like this: ``` app.use(express.session({ secret: "gdagadgagd", cookie: { httpOnly: true, path : '/', maxAge: 1000*60*60*24*30*12 } })); app.use(express.csrf()); app.use(function(req, res, next) { res.locals.token = req.session._csrf; next(); }) ``` and on my page the token appears as: ``` <input type="hidden" name="_csrf" value="E3afFADF3913-fadFK31"> ``` But when I try to register on my webpage, I get this error: ``` Error: Forbidden at Object.exports.error (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/utils.js:55:13) at Object.handle (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41) at next (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/proto.js:190:15) at next (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/session.js:313:9) at /Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/session.js:337:9 at /Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/session/memory.js:50:9 at process._tickCallback (node.js:415:13) ``` I'm using Jade as my template engine and this is what I have: ``` input(type='hidden', name='_csrf', value=token) ``` I am accessing the webpage directly at localhost:3000 and I'm not sure why I am forbidden from registering an account. Thanks!