BillBryson
I have an Elixir application that uses Phoenix for the interface. This application has a contact form that needs to be embedded in other websites. Once the form is embedded via an iFrame in the other websites and then submitted, it returns an error:
invalid CSRF (Cross Site Request Forgery) token, please make sure that:
* The session cookie is being sent and session is loaded
* The request include a valid '_csrf_token' param or 'x-csrf-token' header
Because I can’t control the domains of the websites I can’t update the plug Plug.Session opts.
Am I correct in my understanding that CSRF is mostly to protect with authenticated sessions? Since this is a simple contact form that will be embedded can I remove the CSRF check for this POST route or is there a better way to handle this?
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Courses that'll move you from confusion to "Aha, now I get it!"
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixir-ls
- #ai
- #elixirconf-us
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 3- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
kokolegorille
This can be done in your router, by moving protect_from_forgery plug to it’s own named pipeline. Then using it (or not!) when needed
See related docs for protect_from_forgery.
BillBryson
Thank you
That’s the current workaround I have right now. I guess I’m curious if I am OK doing this from my application from a security standpoint? Will doing that put my application at risk?
nathanl
I know this is an old question, but only the routes you exempt from
:protect_from_forgerybecome less secure. In the example you gave, potentially an attacker could use this sort of attack to get visitors on another site to submit your form, but if it’s an unauthenticated route, I’m not sure there would be any point in doing that vs scripting a bunch of bogus submissions.