javascript - 无法摆脱 ForbiddenError : invalid csrf token on express with csurf

Question

我读了很多关于该主题的帖子，但似乎没有一个对我收到的错误消息“ForbiddenError:无效的 csrf token ”有帮助。

从下面的入口app.js文件中可以看到，我在session中设置了csrf值，然后我可以在模板中使用它:

import * as express from "express"
import users from "./src/users/boundaries-users/users-boundaries"
import * as directory from "./src/directory/boudaries-directory/links-boudaries"
import * as comment from "./src/comments/boundaries-comments/comments-boundaries"
import admin from "./src/@admin/boundaries-admin/admin-boundaries"
import * as session from "express-session"
import Home from "./src/home/use-cases-home/home-case"
import * as email from "./src/utilities-global/email"
import * as csrf from "csurf"
let nodemailer = require( "nodemailer" )

let app = express()

/** Session */
app.use( session( { "secret": "taracebulba" } ) )
/*
 Middleware used to allow template system to acces session information. Must be placed between session and routes middlewares.
 http://expressjs.com/fr/api.html#res.locals and
 http://stackoverflow.com/questions/16823008/express-res-locals-somevariable-use-in-hbs-handlebars-template
 */

app.use( function( req, res, next ) {
    res.locals.session = req.session
    next()
} )


app.use( csrf() )
app.use( function( req, res, next ) {
    res.locals._csrf = req.csrfToken()
    next()
} )


// Console log sessions
app.use( function( req, res, next ) {
    console.log( req.session)
    next()
} )


/* ---------------------------------------------------------------------------------------------------------------*/
// Home url handling
/* ---------------------------------------------------------------------------------------------------------------*/

// Home
app.get( "/", ( req, res ) => {
    const url = "/"

    new Home( req, res ).homeDisplay( undefined, undefined, undefined, "isHome", url )
} )

// Home searched
app.get( "/from/:source/to/:target/:sorting", ( req, res ) => {
    const sourceLanguage = req.params.source
    const targetLanguage = req.params.target
    const sorting        = req.params.sorting
    const url            = req.url

    new Home( req, res ).homeDisplay( sourceLanguage, targetLanguage, sorting, "isNotHome", url )
} )

// Contact
app.get( "/contact", ( req, res ) => {

    res.render( "contact.ejs", {
        "data": {
            "pageTitle": "Contact us"
        }
    } )
} )



/* ---------------------------------------------------------------------------------------------------------------*/
// Routes
/* ---------------------------------------------------------------------------------------------------------------*/
app.use( "/users", users )
app.use( "/directory", directory.routerDirectory )
app.use( "/comment", comment.routerComments )
app.use( "/admin", admin )




/** Views */
app.set( "views", [
    __dirname + "/src/users/views-users",
    __dirname + "/src/directory/views-directory",
    __dirname + "/src/comments/views-comments",
    __dirname + "/src/views-global",
    __dirname + "/src/@admin/views-admin",
    __dirname + "/src/home/views-home"
] )

app.set( "view engine", "ejs" )

app.locals.moment = require( "moment" )



/** Static */
app.use( express.static( __dirname + "/src/@frontend" ) )


/** Handle uncought exception  */
process.on( "uncaughtException", function( er ) {
    const transporter = nodemailer.createTransport( email.smtpConfig )
    console.error( er.stack ) // [3]
    transporter.sendMail( {
        "from"   : "alerts@mycompany.com",
        "to"     : "******@gmail.com",
        "subject": er.message,
        "text"   : er.stack
    }, function( er ) {
        if ( er ) {
            console.error( er )
        }
        process.exit( 1 )
    } )
} )

app.listen( 3000, function() {
    console.log( "Example app listening on port 3000!" )
} )

我检查了 session ，csrfsecret key 就在那里:

  Session {
  cookie: 
   { path: '/',
     _expires: null,
     originalMaxAge: null,
     httpOnly: true },
  csrfSecret: 'JcR1li3zf5bFXZg7fcYQbrz4' }

此外，在生成的模板中我正确地看到了 token :

<form action="/directory/create" method="post">
     <input name="_csrf" value="zN2jALCJ-K2cXntALNBMC9jfioHDuUJmpUks" type="hidden">

因此，如果数据在 session 中，并且 html 将 csrf 值作为隐藏字段，那么为什么这不起作用？是因为我的应用程序使用多个路由路径吗？

Answer 1

从表面上看，您没有使用 body-parser ，这是解析表单以获取 csrf token 所必需的。

安装包

npm install --save body-parser

并需要该包并将其添加到您的中间件之前 csurf。

import bodyParser from 'body-parser';

app.use(bodyParser.urlencoded({
  extended: true
}));