nathanl
CSRF token issue when running Phoenix in a Docker container locally
Recently I wrote a Dockerfile to build and run our Phoenix app in a container in production mode.
When running it locally, everything seemed to work, but when I tried to submit a form, I got a CSRF token error.
My colleague Scott Hamilton figured out that the problem was this bit of configuration for the session - secure: Mix.env() == :prod. I wasn’t’ running https locally, but my containerized Phoenix app was configured not to accept cookies in that case.
The solution was to set that secure: configuration at runtime based on an environment variable, so that I could waive that requirement when running “production” in a local container. (Another option would be to actually run HTTPS locally.)
Just wanted to leave a note about this in case anybody else runs into the problem.
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Develop your skills with books, videos, and courses.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #performance
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First Post!
slouchpie
I had a similar problem to this.
I was using
secure: truein myendpoint.exforPlug.Connsession options and it was making my Wallaby test fail (user could not log in as cookie not sent over http).However, I am very confused because I have been using this config for a long time, including running the server locally and visiting it and logging in over http. Even when running the server in docker with port 4000 exposed and mapped I can visit the site and log in and use normal functionality.