sc4224

sc4224

Looked through the phoenix documentation and I couldn’t find any information on how to deal with invalid CSRF token using :protect_from_forgery.

Currently I have a typeform webhook that makes a POST request to my API whenever someone completes my form.

In my router.ex file I have this:

  if Mix.env() in [:dev, :test] do
    import Phoenix.LiveDashboard.Router

    scope "/" do
      pipe_through [:fetch_session, :protect_from_forgery]

      post "/", ApiWeb.PageController, :index

      live_dashboard "/dashboard", metrics: ApiWeb.Telemetry
    end
  end

When I tested my webhook, my API returned a 403 error saying invalid CSRF token.

When I removed :protect_from_forgery, my API returns a 201.

What I’m trying to do is include :protect_from_forgery and still return a 201 from the typeform webhook call. What am I supposed to do?

Showing Posts 1 to 3

i-n-g-m-a-r

i-n-g-m-a-r

maybe you can pass the csrf token to the typeform?
(never used it, no idea whether it’s possible)
then the typeform could also submit the token along with the post data.

ChrisYammine

ChrisYammine

Simply have a different plug pipeline for API requests that doesn’t include the CSRF check.

picsoung

picsoung

hey @sc4224

if you are trying to prevent someone to submit things into webhook handler endpoint you should probably use the built-in typeform signature.

Typeform signs every payload sent with the secret of your choice. If the signature does not match it means it does not come from Typeform and should not be taken into account.

Here is the documentation

Unfortunately, there is Elixir sample at the moment.

cheers

— All posts loaded —

Where Next? Top

Trending in Questions Top

water
I’m aware of 2 such projects, are there others? git: GitHub - team-alembic/realworld: A fullstack Phoenix LiveView application with back...
New
katta
I having some trouble figuring out if I have set myself too strict of standards for my production server. Currently I can handle 75% of r...
New
peck
Hi everyone. My team and I have been working on a fairly modest app based around video streaming and chat, but we’ve landed a customer t...
New
bradley
I really like the adapter patterns that ecto, nebulex, waffle, etc. use and would love find something similar for a key management servic...
New
unaware8150
Hello folks! So at work, we are seeing some situations where we have to define some “fixed” strings that are used across the codebase in...
New
Alvinkariuki
How Can I Optimise Compile Time Dependencies I have been building an elixir application for about 2 years now. Many modules and files ha...
New
leoschweizer
Hi, we run different LLM models across a cluster, with each node loading a configurable subset. Model-specific queues let nodes consume ...
New

Other Trending Topics Top

budgie
A little off-topic, but I feel like people here have a good head on their shoulders. I used to be quite good at making software. Was luc...
New
KristerV
Hey. Is there anyone here who creates agents in their apps? Not talking about using agents, but creating them. I’m finding it pretty diff...
New
mudasobwa
I fully migrated to my own harness from Anthropic/Gemini and I think it’s time to share it. Welcome DSH, the DeepSeek Harness, fully writ...
New
jimsynz
Beam Bots (or just BB for short) is a framework for building fault-tolerant robotics applications in Elixir using familiar OTP patterns. ...
New
juhalehtonen
There has been a thread to discuss the Stack Overflow Developer Survey on this forum every year since 2018, so here’s yet another one for...
New
budgie
I love Elixir. It’s one of 2 programming languages I’ve ever fallen in love with. But I don’t use it anymore. Serverless was the promis...
New

We're in Beta

About us Mission Statement

Options

Thread Display Mode




Thread Preview

Skip Thread Previews