thojanssens1
Hello 
I want pages to be available for offline usage through a Service Worker, so that the application can be installed as a PWA.
The problem is that I have forms on those pages using CSRF tokens, and those tokens get (I guess) expired at some point. When trying to submit a form with a CSRF token on a page that has been stored a few days ago in the cache, I get the following error:
Plug.CSRFProtection.InvalidCSRFTokenError
invalid CSRF (Cross Site Request Forgery) token, make sure all requests include a valid ‘_csrf_token’ param or ‘x-csrf-token’ header
I’m coming to the conclusion that I can’t store those pages offline; but even my homepage has a form… almost all pages of this app have a form.
So I’d rather have to disable the plug at all; but then I’m not sure to what security risks I expose my app. Or maybe I have to disable the date expiration part of the plug only, is that even possible though?
What is my best option? Any ideas are welcome.
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Courses that'll move you from confusion to "Aha, now I get it!"
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #phoenix_html
- #iex
- #graphql
- #ai
- #genstage
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Bringing learning, work and compliance together since 1987.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 1- Show Best Posts
- Show All Posts (oldest first)
- Show All Posts (newest first)
wolfiton
Hi @thojanssens1
I found this cheat sheet that may provide a better help for your question, it’s the recommendations from oswap the organization that create web security proposals.
Here is the link Cross-Site Request Forgery Prevention - OWASP Cheat Sheet Series