无法摆脱 ForbiddenError: invalid csrf token on express with csurf

Question

我阅读了很多关于该主题的帖子，但似乎都没有帮助我收到错误消息“ForbiddenError: invalid csrf token”。

从下面的入口app.js文件可以看出，我在session中设置了csrf值，然后就可以在模板中使用了：

import * as express from "express"
import users from "./src/users/boundaries-users/users-boundaries"
import * as directory from "./src/directory/boudaries-directory/links-boudaries"
import * as comment from "./src/comments/boundaries-comments/comments-boundaries"
import admin from "./src/@admin/boundaries-admin/admin-boundaries"
import * as session from "express-session"
import Home from "./src/home/use-cases-home/home-case"
import * as email from "./src/utilities-global/email"
import * as csrf from "csurf"
let nodemailer = require( "nodemailer" )

let app = express()

/** Session */
app.use( session( { "secret": "taracebulba" } ) )
/*
 Middleware used to allow template system to acces session information. Must be placed between session and routes middlewares.
 http://expressjs.com/fr/api.html#res.locals and
 http://stackoverflow.com/questions/16823008/express-res-locals-somevariable-use-in-hbs-handlebars-template
 */

app.use( function( req, res, next ) {
    res.locals.session = req.session
    next()
} )


app.use( csrf() )
app.use( function( req, res, next ) {
    res.locals._csrf = req.csrfToken()
    next()
} )


// Console log sessions
app.use( function( req, res, next ) {
    console.log( req.session)
    next()
} )


/* ---------------------------------------------------------------------------------------------------------------*/
// Home url handling
/* ---------------------------------------------------------------------------------------------------------------*/

// Home
app.get( "/", ( req, res ) => {
    const url = "/"

    new Home( req, res ).homeDisplay( undefined, undefined, undefined, "isHome", url )
} )

// Home searched
app.get( "/from/:source/to/:target/:sorting", ( req, res ) => {
    const sourceLanguage = req.params.source
    const targetLanguage = req.params.target
    const sorting        = req.params.sorting
    const url            = req.url

    new Home( req, res ).homeDisplay( sourceLanguage, targetLanguage, sorting, "isNotHome", url )
} )

// Contact
app.get( "/contact", ( req, res ) => {

    res.render( "contact.ejs", {
        "data": {
            "pageTitle": "Contact us"
        }
    } )
} )



/* ---------------------------------------------------------------------------------------------------------------*/
// Routes
/* ---------------------------------------------------------------------------------------------------------------*/
app.use( "/users", users )
app.use( "/directory", directory.routerDirectory )
app.use( "/comment", comment.routerComments )
app.use( "/admin", admin )




/** Views */
app.set( "views", [
    __dirname + "/src/users/views-users",
    __dirname + "/src/directory/views-directory",
    __dirname + "/src/comments/views-comments",
    __dirname + "/src/views-global",
    __dirname + "/src/@admin/views-admin",
    __dirname + "/src/home/views-home"
] )

app.set( "view engine", "ejs" )

app.locals.moment = require( "moment" )



/** Static */
app.use( express.static( __dirname + "/src/@frontend" ) )


/** Handle uncought exception  */
process.on( "uncaughtException", function( er ) {
    const transporter = nodemailer.createTransport( email.smtpConfig )
    console.error( er.stack ) // [3]
    transporter.sendMail( {
        "from"   : "alerts@mycompany.com",
        "to"     : "******@gmail.com",
        "subject": er.message,
        "text"   : er.stack
    }, function( er ) {
        if ( er ) {
            console.error( er )
        }
        process.exit( 1 )
    } )
} )

app.listen( 3000, function() {
    console.log( "Example app listening on port 3000!" )
} )

我检查了会话并且 csrfsecret 密钥在那里：

  Session {
  cookie: 
   { path: '/',
     _expires: null,
     originalMaxAge: null,
     httpOnly: true },
  csrfSecret: 'JcR1li3zf5bFXZg7fcYQbrz4' }

另外，在生成的模板中，我正确地看到了令牌：

<form action="/directory/create" method="post">
     <input name="_csrf" value="zN2jALCJ-K2cXntALNBMC9jfioHDuUJmpUks" type="hidden">

因此，如果数据在会话中，并且 html 将 csrf 值作为隐藏字段，那么为什么这不起作用？是不是因为我的应用使用了多个路由路径？

Answer 1

“Ben Fortune”的回答让我找到了正确的方向：系统无法在没有 bodyParser 的情况下解析表单以检查提交的令牌值。

添加 bodyParser 解决了令牌问题，但引入了一个新问题，与我使用的另一个表单解析器发生冲突，我不是用作中间件，而是在本地使用：强大。

解决方案：

我完全删除了 bodyParser 中间件，并保持了我的强大表单处理原样。 但是，在包含表单的模板上，我添加的标记不是作为隐藏输入，它不会被识别，而是作为查询字符串：

<form action="/directory/create?_csrf=<%= _csrf %>" method="post">

这解决了问题。

Answer 2

从外观上看，您没有使用body-parser，这是解析表单以获取 csrf 令牌所必需的。

安装包

npm install --save body-parser

并且需要该包并将其添加到您的中间件之前 csurf。

import bodyParser from 'body-parser';

app.use(bodyParser.urlencoded({
  extended: true
}));