aesmail

aesmail

Hello, I’m having a hard time understanding why I’m getting the error:

invalid CSRF (Cross Site Request Forgery) token, make sure all requests include a valid '_csrf_token' param or 'x-csrf-token' header

Even though the form has a _csrf_token field with the value of Plug.CSRFProtection.get_csrf_token().

I tried setting it directly in the form like:
<input type="hidden" name="_csrf_token" value="<%= @token %>">

And using the form_for function which auto generates the csrf token.

In both cases, the token is there, however, when I post the form, I always get the Plug.CSRFProtection.InvalidCSRFTokenError exception stating that a valid token should be present.

For extra context, my pipeline is:

pipeline :browser do
  plug :accepts, ["html"]
  plug :fetch_session
  plug :fetch_flash
  plug :protect_from_forgery
  plug :put_secure_browser_headers
  plug MyApp.Plugs.SubdomainPlug
end

Any help would be appreciated.

EDIT
I’m using the following:
phoenix 1.4.9
phoenix_html 2.13.3
plug 1.8.2

Showing Posts 1 to 2

aesmail

aesmail OP

Solved weirdly enough almost immediately after posting the original post.

I had the following in endpoint.ex:

plug Plug.Session,
  domain: ".production-name.com",
  store: :cookie,
  key: "_kashout_key",
  signing_salt: "some_salt"

Changed the domain option to the local domain (e.g. .production-name.dev) and the csrf token was validated correctly.

Struggled with this for a few days until I removed the :protect_from_forgery plug from the pipeline to continue development.

It would be nice if phoenix could warn me about this while in dev environment. Either way I’m glad this is over now and hopefully it would help someone else down the road.

VAK-53

VAK-53

I had the same error CSRF, which stopped appearing after your advice, but in fact the error did not go anywhere. Imho, it is ignored.

— All posts loaded —

Where Next? Top

Trending in Questions Top

katta
I having some trouble figuring out if I have set myself too strict of standards for my production server. Currently I can handle 75% of r...
New
brecabral
Documentation While reading the Scoped Routes section, I noticed that the documentation currently refers to a problem without explainin...
New
achenet
Hello, I’m trying to build a basic Phoenix web-app, and I’d like to use Tailwind. However, when I launch mix phx.server, I get an error...
New
kpanic
Hi everyone, I am toying with the idea of building a “match maker” for giving personal help to people that wants to start coding. I sta...
New
velrest
So my question is quite simple and i have found no conclusive answer on forum, google or AI. Should we use :erlang.float for Integer to ...
New
asweet-confluent
I recently noticed that Elixir’s Logger defaults its primary log level to :debug when no :logger, :level application configuration is pre...
New
mnkhod
So i have been using ash framework for a while and i love it. However currently the issue im having with ash framework is the error handl...
New

Other Trending Topics Top

GenericJam
Edit: 2026 May 15 - This post is archived. Mob is alive!! Main docs: mob v0.7.11 — Documentation A bit of explanation for the slightly c...
New
JesseHerrick
Hey, I’m Jesse and I’m the main contributor behind Dexter, a full-featured, lightning-fast Elixir LSP optimized for large codebases. It s...
New
mudasobwa
I am happy to introduce the very α version of the new programming language compiled to BEAM. Welcome Cure. It has literally three kille...
New
garrison
Hobbes is a low-level distributed database for the Elixir programming language. Hobbes provides a simple, safe, and scalable storage lay...
New
mhanberg
Hi everyone! The first release candidate for the Expert language server project is now available! We’ve published a press release detai...
New
budgie
A little off-topic, but I feel like people here have a good head on their shoulders. I used to be quite good at making software. Was luc...
New

We're in Beta

About us Mission Statement

Options

Thread Display Mode




Thread Preview

Skip Thread Previews