Questions & Help>Questions

PWA (Service Worker) and "invalid CSRF (Cross Site Request Forgery) token"

#csrf#service-worker#pwa
thojanssens1

thojanssens1

PWA (Service Worker) and "invalid CSRF (Cross Site Request Forgery) token"

Hello :waving_hand:

I want pages to be available for offline usage through a Service Worker, so that the application can be installed as a PWA.

The problem is that I have forms on those pages using CSRF tokens, and those tokens get (I guess) expired at some point. When trying to submit a form with a CSRF token on a page that has been stored a few days ago in the cache, I get the following error:

Plug.CSRFProtection.InvalidCSRFTokenError
invalid CSRF (Cross Site Request Forgery) token, make sure all requests include a valid ‘_csrf_token’ param or ‘x-csrf-token’ header

I’m coming to the conclusion that I can’t store those pages offline; but even my homepage has a form… almost all pages of this app have a form.
So I’d rather have to disable the plug at all; but then I’m not sure to what security risks I expose my app. Or maybe I have to disable the date expiration part of the plug only, is that even possible though?

What is my best option? Any ideas are welcome.

1 comment
#csrf#service-worker#pwa
1 2286 1

First Post!

wolfiton

wolfiton

Hi @thojanssens1

I found this cheat sheet that may provide a better help for your question, it’s the recommendations from oswap the organization that create web security proposals.

Here is the link Cross-Site Request Forgery Prevention - OWASP Cheat Sheet Series

Post #2

Where Next?

View thread on forum (has 1 response!)
csrf
service-worker
pwa
Home Questions & Help>Questions
#csrf#service-worker#pwa
1 2286 1
Last post

Popular in Questions Top

sergio
Questions & Help>Questions

Updating a field using Ecto one-liner?
In Ruby, I can go: User.find_by(email: "foobar@email.com").update(email: "hello@email.com") How can I do something similar in Elixir? ...
15 14719 3
New
hariharasudhan94
Questions & Help>Questions

How to use return statement with if condition in elixir?
lets say i have a sample like a = 20; b = 10; if (a > b) do {:ok, "a"} end if (a < b) do {:ok, b} end if (a == b) do {:ok, "equa...
/phoenix
10 20249 6
New
Darmani72
Questions & Help>Questions

Params in the URL and body -- how does Phoenix handle them together?
If I have a post route which an argument: post /my_post_route/:my_param1, MyController.my_post_handler How would get the post params ...
/phoenix#params
17 27034 14
New
jononomo
Questions & Help>Questions

Where / How does the Mix environment variable get set?
I am trying to figure out how Mix knows whether the environment is test, dev, or prod – where is this set? Thanks.
#mix
31 23135 9
New
pmjoe
Questions & Help>Questions

What do you think of Gleam compared to Elixir?
I have a relationship of love and hate with Elixir. Lots of things are just absolutely right, but there are some things that are kind of ...
#programminguages#gleam
24 17623 10
New
Fl4m3Ph03n1x
Questions & Help>Questions

Learning Elixir, frst impressions ( plz don't kill me ! )
About me? ( if you have nothing better to do than reading about some random guy in the internet :stuck_out_tongue: ) Hello all, this is ...
#learning-elixir
371 26388 61
New
itssasanka
Questions & Help>Questions

Why use `utc_datetime` over `naive_datetime` for Ecto?
Hi all, Trying to get some more clarity over utc_datetime and naive_datetime for Ecto: The documentation above suggests that while ...
#ecto#timestamps#datetime#timezones
115 15293 19
New
JDanielMartinez
Questions & Help>Questions

** (RuntimeError) could not lookup Ecto repo Repo because it was not started or it does not exist
Hi! May someone helps me, please! I have two apps into an umbrella project: the first one is Database, which manages queries, and the se...
#umbrella#testing#repo#runtimeerror
11 15351 14
New
RisingFromAshes
Questions & Help>Questions

How to get the current URL?
I’ve read in another post that it may be possible with a router helper - but I couldn’t find an appropriate one, and tbh, I’m still just ...
/phoenix
20 18837 18
New
rms.mrcs
Questions & Help>Questions

Transform a list into an map with indexes using Enum module
Hi, I need to transform a list of numbers into a map where the keys are the indexes and the values are the original values of the list. ...
35 32927 9
New

Other popular topics Top

9mm
Questions & Help>Questions

Elixir way to conditionally update a map
I am constructing a JSON object (map) and I need to conditionally set a field. I’m trying to write proper elixir-way code… and I’m at a l...
#maps
55 20289 29
New
lessless
Questions & Help>Questions

How are you dealing with CSV files that uses CR line breaks?
I believe there are people here who are dealing with CSV files import on the daily basis, and since Excel is a really popular tool there ...
#how-to-question
10 18778 17
New
stefanchrobot
Questions & Help>Questions

How to decode a JSON into a struct safely?
What’s the safe way to decode a JSON string into a struct? I want to avoid calling String.to_atom. Jason.decode can give me a map with st...
#structs#json
29 21253 26
New
AngeloChecked
Chat & Discussions>Discussions

What to learn first - Rust or Elixir?
What learn first? Rust or Elixir Hi Elixir community! I’m here because i want learn a new language. I’m a junior developer and mainly i ...
#learning-elixir
54 22638 20
New
freewebwithme
Questions & Help>Questions

Failed to run 'elixir' command error in vs code
Using vs code and installed ElixirLS: support and debugger. And I got an error popped up on start up says Failed to run ‘elixir’ comma...
#vscode#elixir-ls
49 16657 39
New
joeerl
Questions & Help>Questions

Upgrading Elixir - how to check versions, delete, and upgrade?
Hello again - after a longish gap I’ve decided I really must dig into Elixir and see what’s been happening here - so I have a few questio...
#upgrade
63 41663 13
New
sergio_101
Questions & Help>Questions

Pattern matching against a string
I am VERY much an elixir newbie. I have taken one elixir course and one phoenix course on Udemy. During that course, I saw the instructor...
#pattern-matching
28 27371 14
New
rms.mrcs
Questions & Help>Questions

Transform a list into an map with indexes using Enum module
Hi, I need to transform a list of numbers into a map where the keys are the indexes and the values are the original values of the list. ...
35 32927 9
New
shijith.k
Questions & Help>Questions

Hex version - ** (Mix) The task "phx.new" could not be found
I am trying to start a new phoenix project with elixir 1.9, but mix phx.new does not work. It says that ** (Mix) The task "phx.new" could...
/phoenix#hex
66 25484 15
New
hariharasudhan94
Questions & Help>Questions

How to get struct from map - elixir?
Lets say I have map like this fetching from my database %{"_id" => #BSON.ObjectId<58eb1a7a9ad169198c3dXXXX>, "email" => ...
/phoenix#ecto#maps#structs
38 34931 34
New
Back to top

Questions & Help>Questions

Questions Questions ❯

Latest on Elixir Forum

Elixir Forum ❯

Sponsor Spotlight

Honeybadger

Real-time error tracking, performance insights, and observability for devs.

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Honeybadger

Real-time error tracking, performance insights, and observability for devs.

Manning

Develop your skills with books, videos, and courses.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Software Mansion

The team behind Membrane, Popcorn, LiveDebugger. Available for hire.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

Categories:

Sub Categories:

Forums

Popular Tags

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Honeybadger

Real-time error tracking, performance insights, and observability for devs.

Manning

Develop your skills with books, videos, and courses.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Software Mansion

The team behind Membrane, Popcorn, LiveDebugger. Available for hire.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

We're in Beta

About us Mission Statement