Safari 7.04 403 "invalid csrf token"

[expressjs]

Safari 7.04 403 "invalid csrf token"

[dstroot]

As I wrote the above I realized that since the app wasn't actually running over SSL and Nodejitsu was doing the SSL termination I turned off secure cookies and all is well with Safari.

Now I'm wondering how Chrome was working! ???

[dougwilson]

Now I'm wondering how Chrome was working! ???

It's possible Chrome had a cookie in there from you but not marked secure (perhaps it got there at a time in your development before you added the secure flag?). If you clear your cookies in Chrome and try it without SSL like Safari was, perhaps it will show the same behavior :)

[dstroot]

Thanks Doug. I also discovered proxy: true in Express session. ;)

This works:

  app.use(session({
    secret: config.session.secret,
    name: 'sessionId',  // Use something generic so you don't leak information about your server
    cookie: {
      httpOnly: true,  // Reduce XSS attack vector
      proxy: true,     // Trust the reverse proxy when setting secure cookies
      secure: true,    // Cookies via SSL
      maxAge: config.session.maxAge
    },
    store: new MongoStore({
      mongoose_connection: db,
      auto_reconnect: true
    })
  }));

[dougwilson]

I also discovered proxy: true in Express session.

Ah yes. I guess it should really use express's helpers to get the protocol so it will use your "trust proxy" setting from our express app directly instead of setting it multiple times.