In development I noticed that when I update to the latest version of Phoenix (1.6.7), I now receive an invalid csrf error when attempting to login.

Deps Versions that work

• phoenix 1.6.6
• plug 1.13.4 / 1.13.6
• phoenix_live_view 0.17.7 / 0.17.9
• phoenix_pubsub 2.1.0 / 2.1.1

Error on phoenix 1.6.7

  * The session cookie is being sent and session is loaded
  * The request include a valid '_csrf_token' param or 'x-csrf-token' header
    (plug 1.13.6) lib/plug/csrf_protection.ex:316: Plug.CSRFProtection.call/2
    (metamorphic_web 0.1.0) MetamorphicWeb.Router.browser/2
    (metamorphic_web 0.1.0) lib/metamorphic_web/router.ex:1: MetamorphicWeb.Router.__pipe_through9__/1
    (phoenix 1.6.7) lib/phoenix/router.ex:347: Phoenix.Router.__call__/2
    (metamorphic_web 0.1.0) lib/metamorphic_web/endpoint.ex:1: MetamorphicWeb.Endpoint.plug_builder_call/2
    (metamorphic_web 0.1.0) lib/plug/debugger.ex:136: MetamorphicWeb.Endpoint."call (overridable 3)"/2
    (metamorphic_web 0.1.0) lib/metamorphic_web/endpoint.ex:1: MetamorphicWeb.Endpoint.call/2
    (phoenix 1.6.7) lib/phoenix/endpoint/cowboy2_handler.ex:54: Phoenix.Endpoint.Cowboy2Handler.init/4
    (cowboy 2.9.0) /home/mark/github/eclogite/deps/cowboy/src/cowboy_handler.erl:37: :cowboy_handler.execute/2
    (cowboy 2.9.0) /home/mark/github/eclogite/deps/cowboy/src/cowboy_stream_h.erl:306: :cowboy_stream_h.execute/3
    (cowboy 2.9.0) /home/mark/github/eclogite/deps/cowboy/src/cowboy_stream_h.erl:295: :cowboy_stream_h.request_process/3
    (stdlib 3.17) proc_lib.erl:226: :proc_lib.init_p_do_apply/3

Router
Below is router.ex file:

defmodule MetamorphicWeb.Router do
  use MetamorphicWeb, :router

  import Phoenix.LiveDashboard.Router
  import MetamorphicWeb.PersonAuth

  alias MetamorphicWeb.Plugs.{EnsurePrivilege, VerifyPortalPass, PlugAttack}

  if Application.get_env(:metamorphic_web, :http_headers) == :prod do
    pipeline :browser do
      plug PlugAttack
      plug :accepts, ["html"]
      plug :fetch_session
      plug :fetch_live_flash
      plug :protect_from_forgery

      plug :put_secure_browser_headers, %{
        "referrer-policy" => "no-referrer",
        "permissions-policy" => "interest-cohort=()",
        "strict-transport-security" => "max-age=31536000; includeSubDomains"
      }

      plug :fetch_current_person
    end

    pipeline :gpc do
      plug PlugAttack
      plug :accepts, ["json"]
    end
  else
    pipeline :browser do
      plug PlugAttack
      plug :accepts, ["html"]
      plug :fetch_session
      plug :fetch_live_flash
      plug :protect_from_forgery

      plug :put_secure_browser_headers, %{
        "referrer-policy" => "no-referrer",
        "permissions-policy" => "interest-cohort=()"
      }

      plug :fetch_current_person
    end

    pipeline :gpc do
      plug PlugAttack
      plug :accepts, ["json"]
    end
  end

  pipeline :api do
    plug PlugAttack
    plug :accepts, ["json"]
  end

  pipeline :marketing_layout do
    plug :put_root_layout, {MetamorphicWeb.LayoutView, :marketing}
  end

  pipeline :pre_release_layout do
    plug :put_root_layout, {MetamorphicWeb.LayoutView, :pre_release}
  end

  pipeline :register_layout do
    plug :put_root_layout, {MetamorphicWeb.LayoutView, :register}
  end

  pipeline :app_layout do
    plug :put_root_layout, {MetamorphicWeb.LayoutView, :root}
  end

  pipeline :admin do
    plug EnsurePrivilege, :admin
  end

  pipeline :person do
    plug EnsurePrivilege, [:admin, :person]
  end

  pipeline :require_portal_pass do
    plug VerifyPortalPass
  end

  # Other scopes may use custom stacks.
  # scope "/api", MetamorphicWeb do
  #   pipe_through :api
  # end

  # Enables LiveDashboard only for development
  #
  # If you want to use the LiveDashboard in production, you should put
  # it behind authentication and allow only admins to access it.
  # If your application does not have an admins-only section yet,
  # you can use Plug.BasicAuth to set up some basic authentication
  # as long as you are also using SSL (which you should anyway).
  #
  # We are using live dash in production. It is behind the admin
  # authentication and authorization.

  # Enables displaying emails via Bamboo LocalAdapter for
  # development.
  if Mix.env() == :dev do
    # If using Phoenix
    forward "/sent_emails", Bamboo.SentEmailViewerPlug
  end

  # Health check
  scope "/", MetamorphicWeb do
    pipe_through [:browser, :marketing_layout]

    get "/healthz", HealthCheckController, :index, as: :health_check
  end

  # Global Privacy Control route.
  scope "/", MetamorphicWeb do
    pipe_through [:gpc]

    get "/.well-known/gpc.json", GlobalPrivacyController, :global_privacy_response
  end

  ##
  ## Requires AUTHENTICATED person routes
  ##

  # 2FA (two-factor authentication).
  scope "/", MetamorphicWeb do
    pipe_through [:browser, :register_layout, :require_authenticated_person, :person]

    get "/people/totp", PersonTOTPController, :new
    post "/people/totp", PersonTOTPController, :create
  end

  # Subscriptions
  scope "/", MetamorphicWeb do
    pipe_through [
      :browser,
      :register_layout,
      :require_authenticated_person,
      :redirect_if_person_has_subscription
    ]

    live "/subscriptions/new", SubscriptionLive.New, :new
  end

  # Dashboard, settings, and support.
  scope "/", MetamorphicWeb do
    pipe_through [
      :browser,
      :app_layout,
      :require_authenticated_person,
      :redirect_if_admin,
      :person
    ]

    live_session :authenticated_redirect_if_admin,
      root_layout: {MetamorphicWeb.LayoutView, :root},
      on_mount: [{MetamorphicWeb.PersonLiveAuth, :redirect_if_admin}, MetamorphicWeb.Nav] do
      live "/dashboard", DashboardLive.Index, :index, as: :dashboard
      live "/people/settings", PersonSettingsLive.Index, :index, as: :person_settings
      live "/people/settings/billing", PersonSettingsLive.Billing, :billing, as: :person_settings
      live "/people/settings/data", PersonSettingsLive.Data, :data, as: :person_settings
      live "/people/settings/security", PersonSettingsLive.Security, :security, as: :person_settings
      live "/support", SupportLive.Index, :index, as: :support
    end

    get "/people/settings/data/download-stripe-data",
        PersonSettingsController,
        :download_stripe_data

    get "/people/settings/data/download-encrypted-person",
        PersonSettingsController,
        :download_encrypted_person_data

    get "/people/settings/data/download-encrypted-memories",
        PersonSettingsController,
        :download_encrypted_memory_data

    get "/people/settings/data/download-encrypted-letters",
        PersonSettingsController,
        :download_encrypted_letter_data

    get "/people/settings/data/download-encrypted-portals",
        PersonSettingsController,
        :download_encrypted_portal_data

    get "/people/settings/data/download-encrypted-person-relationships",
        PersonSettingsController,
        :download_encrypted_relationship_person_data

    get "/people/settings/data/download-encrypted-relation-relationships",
        PersonSettingsController,
        :download_encrypted_relationship_relation_data

    get "/people/settings/confirm_email/:token", PersonSettingsController, :confirm_email
    put "/people/settings/update_password", PersonSettingsController, :update_password
  end

  # Log out.
  scope "/", MetamorphicWeb do
    pipe_through [:browser, :app_layout, :require_authenticated_person, :person]

    delete "/people/log_out", PersonSessionController, :delete
  end

  # Letters, memories, relationships, portals (:index, :new, and :edit).
  scope "/", MetamorphicWeb do
    pipe_through [
      :browser,
      :app_layout,
      :require_authenticated_person,
      :require_active_subscription,
      :person
    ]

    live_session :authenticated,
      root_layout: {MetamorphicWeb.LayoutView, :root},
      on_mount: [{MetamorphicWeb.PersonLiveAuth, :ensure_authenticated}, MetamorphicWeb.Nav] do
      live "/letters", LetterLive.Index, :index, as: :letters
      live "/letters/new", LetterLive.Index, :new, as: :letters
      live "/letters/mailbox", LetterLive.Mailbox, :mailbox, as: :letters
      live "/letters/mailbox/new", LetterLive.Mailbox, :compose, as: :letters
      live "/letters/:id/read", LetterLive.Mailbox, :read, as: :letters
      # live "/letters/:id/edit", LetterLive.Index, :edit, as: :letters

      live "/memories", MemoryLive.Index, :index, as: :memories
      # live "/memories/:id/edit", MemoryLive.Index, :edit, as: :memories
      live "/memories/new", MemoryLive.Index, :new, as: :memories

      get "/memories/shared/download", MemoryDownloadsController, :download_shared_memory,
        as: :memories

      get "/memories/download", MemoryDownloadsController, :download_memory, as: :memories
      # live "/memories/:id", MemoryLive.Show, :show, as: :memories
      # live "/memories/:id/show/edit", MemoryLive.Show, :edit

      live "/portals", PortalLive.Index, :index, as: :portal
      # live "/portals/:id/edit", PortalLive.Index, :edit, as: :portal
      live "/portals/new", PortalLive.New, :new, as: :portal

      live "/relationships", RelationshipLive.Index, :index, as: :relationships
      live "/relationships/new", RelationshipLive.Index, :new, as: :relationships
      live "/relationships/:id/edit", RelationshipLive.Index, :edit, as: :relationships
      # live "/relationships/:id", RelationshipLive.Show, :show
      # live "/relationships/:id/show/edit", RelationshipLive.Show, :edit

      live "/roadmap", RoadmapLive.Index, :index, as: :roadmap
    end
  end

  # Portals (:show) with :require_portal_pass plug.
  scope "/", MetamorphicWeb do
    pipe_through [
      :browser,
      :app_layout,
      :require_authenticated_person,
      :require_active_subscription,
      :require_portal_pass,
      :person
    ]

    live "/portals/open/:slug", PortalLive.Show, :show, as: :portal
  end

  ##
  ## Does NOT require authenticated person routes
  ##

  # Registration and log in pages for people's accounts.

  scope "/", MetamorphicWeb do
    pipe_through [:browser, :register_layout, :redirect_if_person_is_authenticated]

    get "/people/log_in", PersonSessionController, :new
    post "/people/log_in", PersonSessionController, :create

    live_session :register,
      root_layout: {MetamorphicWeb.LayoutView, :register},
      on_mount: {MetamorphicWeb.PersonLiveAuth, :register} do
      live "/people/register", PersonRegistrationLive.New, :new, as: :person_registration
    end

    # get "/people/reset_password", PersonResetPasswordController, :new
    # post "/people/reset_password", PersonResetPasswordController, :create
    # live "/people/reset_password/:token", PersonResetPasswordLive.Edit, :edit, as: :person_reset_password
    # put "/people/reset_password/:token", PersonResetPasswordController, :update
  end

  # Resend confirmation instructions for a person's account.

  scope "/", MetamorphicWeb do
    pipe_through [:browser, :register_layout]

    get "/people/confirm", PersonConfirmationController, :new
    post "/people/confirm", PersonConfirmationController, :create
    get "/people/confirm/:token", PersonConfirmationController, :confirm
    get "/invitations/confirm", InviteConfirmationController, :new
    post "/invitations/confirm", InviteConfirmationController, :create
    get "/invitations/confirm/:token", InviteConfirmationController, :confirm
  end

  # Marketing pages.
  scope "/", MetamorphicWeb do
    pipe_through [:browser, :marketing_layout]

    # live_session :pre_release, root_layout: {MetamorphicWeb.LayoutView, :pre_release}, on_mount: {MetamorphicWeb.PersonLiveAuth, :pre_release} do
    # live "/", PageLive.Index, :index, as: :page
    # end

    live_session :marketing,
      root_layout: {MetamorphicWeb.LayoutView, :marketing},
      on_mount: {MetamorphicWeb.PersonLiveAuth, :marketing} do
      live "/", PageLive.Index, :index, as: :page
      live "/about", AboutLive.Index, :index, as: :about
      live "/built-to-code", BuiltToCodeLive.Index, :index, as: :built_to_code
      live "/customer-rights", CustomerRightsLive.Index, :index, as: :customer_rights
      live "/faq", FaqLive.Index, :index, as: :faq
      live "/features", FeaturesLive.Index, :index, as: :features
      live "/find-your-peace", FindYourPeaceLive.Index, :index, as: :find_your_peace
      live "/hassle-free", HassleFreeLive.Index, :index, as: :hassle_free
      live "/pricing", PricingLive.Index, :index, as: :pricing
      live "/privacy", PrivacyLive.Index, :index, as: :privacy
      live "/security", SecurityLive.Index, :index, as: :security
      live "/rocks", SpecialThanksLive.Index, :index, as: :thanks
      live "/terms", TermsLive.Index, :index, as: :terms
      live "/why-metamorphic", WhyMetamorphicLive.Index, :index, as: :why_metamorphic

      live "/blog", BlogLive.Index, :index, as: :blog

      live "/blog/clean-cookies", BlogLive.Posts.CleanCookies, :index,
        as: :blog_posts_clean_cookies

      live "/blog/early-access-sign-ups", BlogLive.Posts.EarlyAccessSignUps, :index,
        as: :blog_posts_early_access_sign_ups

      live "/blog/markdown-guide", BlogLive.Posts.MarkdownGuide, :index,
        as: :blog_posts_markdown_guide
    end
  end

  # Pre-release invitations page.
  # scope "/", MetamorphicWeb do
  #  pipe_through [:browser, :pre_release_layout]

  # live "/", PageLive.Index, :index, as: :page
  # end

  ##
  ## Requires ADMIN AUTHENTICATED routes.
  ##

  scope "/odus", MetamorphicWeb do
    pipe_through [:browser, :app_layout, :require_authenticated_person, :admin]
    live_dashboard "/sys_dash", metrics: MetamorphicWeb.Telemetry
  end

  scope "/odus", MetamorphicWeb do
    pipe_through [:browser, :app_layout, :require_authenticated_person, :admin]

    live_session :admin,
      root_layout: {MetamorphicWeb.LayoutView, :root},
      on_mount: [{MetamorphicWeb.PersonLiveAuth, :admin}, MetamorphicWeb.Nav] do
      live "/dashboard", DashboardLive.Admin, :admin, as: :admin_dashboard
      live "/invitations", InviteLive.Admin, :admin, as: :admin_invite
      live "/invitations/new", InviteLive.Admin, :admin_new, as: :admin_invite_new
      live "/invitations/:id/edit", InviteLive.Admin, :admin_edit, as: :admin_invite_edit
      live "/invitations/:id", InviteLive.Show, :show
      live "/invitations/:id/show/edit", InviteLive.Show, :edit
      live "/people/settings", PersonSettingsLive.Admin, :admin, as: :admin_settings
      live "/roadmap", RoadmapLive.Admin, :admin, as: :admin_roadmap
      live "/roadmap/new", RoadmapLive.Admin, :admin_new, as: :admin_roadmap_new
      live "/roadmap/:id/edit", RoadmapLive.Admin, :admin_edit, as: :admin_roadmap_edit
      live "/roadmap/:id/update", RoadmapLive.Admin, :admin_update, as: :admin_roadmap_update
      live "/roadmap/:id/delete", RoadmapLive.Admin, :admin_delete, as: :admin_roadmap_delete
      live "/support", SupportLive.Admin, :admin, as: :admin_support
    end

    get "/people/settings/data/download-encrypted-admin",
        PersonSettingsController,
        :download_encrypted_admin_data

    get "/people/settings/confirm_email/:token", PersonSettingsController, :confirm_email
    put "/people/settings/update_password", PersonSettingsController, :update_password
    delete "/people/log_out", PersonSessionController, :delete
  end
end