Question

在使用csurf软件包时，我们遇到CSRF禁止错误。奇怪的是，它仅影响几百个用户。这些受影响的用户始终是相同的用户。我不相信这与将csrf令牌传递给浏览器有关，因为99％的请求都可以工作。我想知道我的配置是否有问题，导致这些令牌错误地过期。还是用户计算机即将到期的问题所在。遇到这种情况的用户具有有效的登录名和会话。

我在日志中看到以下内容：

ForbiddenError：无效的CSRF令牌在csrf（/cme/apps/install/express_server/node_modules/csurf/index.js:112:19）在Layer.handle [作为handle_request]（/cme/apps/install/express_server/node_modules/express/lib/router/layer.js:95:5）在trim_prefix（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:317:13）在/cme/apps/install/express_server/node_modules/express/lib/router/index.js:284:7 在Function.process_params（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:335:12）在下一个（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:275:10）在cookieParser（/cme/apps/install/express_server/node_modules/cookie-parser/index.js:71:5）在Layer.handle [作为handle_request]（/cme/apps/install/express_server/node_modules/express/lib/router/layer.js:95:5）在trim_prefix（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:317:13）在/cme/apps/install/express_server/node_modules/express/lib/router/index.js:284:7 在Function.process_params（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:335:12）在下一个（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:275:10）在methodOverride（/cme/apps/install/express_server/node_modules/method-override/index.js:79:5）在Layer.handle [作为handle_request]（/cme/apps/install/express_server/node_modules/express/lib/router/layer.js:95:5）在trim_prefix（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:317:13）在/cme/apps/install/express_server/node_modules/express/lib/router/index.js:284:7 在Function.process_params（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:335:12）在下一个（/cme/apps/install/express_server/node_modules/express/lib/router/index.js:275:10）在internalNext（/cme/apps/install/express_server/node_modules/helmet/index.js:47:33）在xXssProtection（/cme/apps/install/express_server/node_modules/x-xss-protection/index.js:26:7）在internalNext（/cme/apps/install/express_server/node_modules/helmet/index.js:51:7）在nosniff（/cme/apps/install/express_server/node_modules/dont-sniff-mimetype/index.js:4:5）

这是我当前的设置：

var app = express();

// express configurations
app.enable("strict routing");
app.set("views", __dirname + "/views");
app.set('view engine', 'pug');
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({
  extended: true
}));
app.use(helmet());
app.use(methodOverride());
app.use(cookieParser("secretsecretsecretsessioncode"));

app.set('trust proxy', true);
app.use(csrf({
  cookie: true
}));
app.use(session({
  secret: 'secretsecretsecretsessioncode',
  cookie: {
    maxAge: 12 * 60 * 60 * 1000, // 12 hours
    secure: true
  },
  proxy: true,
  saveUninitialized: true,
  resave: false,
  store: new mongoStore({
    mongooseConnection: mongo.db,
    autoReconnect: true,
    stringify: false
  })
}));
app.use(adldap_model.passport.initialize());
app.use(adldap_model.passport.session());

app.use(function (req, res, next) {
  res.locals.csrftoken = req.csrfToken();
  next();
});

Node.js Random ForbiddenError：通过CSURF软件包无效的csrf令牌

0 个答案: