Repository: gobuffalo/buffalo

Issue #886: CSRF error when Clearing the Session and Redirecting to a form
Created: 2018-01-29T21:30:36Z
We discussed the case with @markbates on Slack.
Here is the error:
CSRF token not found in request
github.com/gobuffalo/buffalo.sessionSaver.func1
    /home/kteb/gowork/src/github.com/gobuffalo/buffalo/session.go:72
github.com/gobuffalo/buffalo.RequestLoggerFunc.func1
    /home/kteb/gowork/src/github.com/gobuffalo/buffalo/request_logger.go:51
github.com/gobuffalo/buffalo.(*App).PanicHandler.func1
    /home/kteb/gowork/src/github.com/gobuffalo/buffalo/errors.go:69
github.com/gobuffalo/buffalo.RouteInfo.ServeHTTP
    /home/kteb/gowork/src/github.com/gobuffalo/buffalo/handler.go:75
github.com/gobuffalo/buffalo.(*RouteInfo).ServeHTTP
    <autogenerated>:1

Here is the code I used
func SetCurrentUser(next buffalo.Handler) buffalo.Handler {
    return func(c buffalo.Context) error {
        if uid := c.Session().Get("current_user_id"); uid != nil {
            u := &models.User{}
            tx := c.Value("tx").(*pop.Connection)
            err := tx.Find(u, uid)
            if err != nil {
                if errors.Cause(err) != sql.ErrNoRows {
                    return errors.WithStack(err)
                }
                c.Session().Clear()
                c.Flash().Add("warning", "We didn't find the session you were connected to, so please reconnect")
                return c.Redirect(302, "/signin")
            }
            c.Set("current_user", u)
        }
        return next(c)
    }
}

I'm using the default form generated by auth:
<%= form_for(user, {action: signinPath()}) { %>
  <%= f.InputTag("Email") %>
  <%= f.InputTag("Password", {type: "password"}) %>
  <button class="btn btn-success">Sign In!</button>
<% } %>

I reproduce it with migrating down the db and migrating up and seeding my default user.
From here it's the explanation of Mark on Slack:
i can reproduce, not sure i know what the fix is, but here’s what’s happening:

you make a call to clear the session
the redirect happens
buffalo renders the template, with the CSRF token in it (it’s there, i saw it in the generated HTML)
the page is rendered, and the request to delete the session cookie completes

this is where things get interesting.
the page is already rendered with a token, however that token was salted using a salt that was in the session that was clear after the page was drawn; cause cookies.
and that’s how you get a CSRF token in a form but not have it be valid. 🙂
the error message is misleading though.
it was found, but it’s not a valid CSRF token.
the work around would be to just delete the current_user_id from the session, but it would be great if someone can figure out a good way to stop this from happening in the future.

Duplicate issue #1090: CSRF token not found in request
Created: 2018-06-07T22:33:52Z
App with these routes:
app.POST("/login", AuthLogin)
app.GET("/login", AuthLoginPage)
app.DELETE("/logout", AuthLogout)

When logging out, I'm deleting session from the endpoint then I redirect it to /login who is a template with a form. I fill all fields to logging again but CSRF token is not generated correctly, which causes it getting this error:
CSRF token not found in request
ERRO[2018-06-07T17:30:05-05:00] CSRF token not found in request content_type=application/x-www-form-urlencoded duration="233.444µs" form="{\"Email\":[\"example@test.com\"],\"Password\":[\"123456789\"],\"authenticity_token\":[\"Gpelbj/ASzG9OylnmmmESlEV5VyUepKCn4nyAzeAX2Q=\"]}" human_size="0 B" method=POST params="{}" path=/login request_id="d44f6ae7af-85b0fc7940" size="0" status="0"

Closing comment (2018-06-07T23:01:34Z): Dup of #886. Will be in the next release.