<@U04UQ68083H> I am using self-hosted Kratos for m...
# ory-copilotb
blue-alarm-98979
04/04/2024, 10:33 AM@chilly-king-10285 I am using self-hosted Kratos for my .NET project and I am trying to implement the login logic.. it looks something like this now: "Configuration config = new Configuration();
config.BasePath = <base_path>;
var frontendApi = new FrontendApi(config);
var cookieHeader = ctx.Request.Headers["cookie"];
var loginflow = frontendApi.CreateBrowserLoginFlow(cookie: cookieHeader);
var flowId = loginflow.Id;
string csrfToken = null;
foreach (var node in loginflow.Ui.Nodes)
{
if (node.Attributes.ActualInstance is KratosUiNodeInputAttributes inputAttributes)
{
if (inputAttributes.Name == "csrf_token")
{
csrfToken = inputAttributes.Value.ToString();
break;
}
}
}
if (csrfToken == null)
{
throw new Exception("CSRF token not found in login flow");
}
KratosUpdateLoginFlowWithPasswordMethod method = new(csrfToken, request.Email, "password", request.Password);
var updateLoginFlowBody = new KratosUpdateLoginFlowBody(method);
var result = frontendApi.UpdateLoginFlow(flowId, updateLoginFlowBody, cookie: cookieHeader);" .. I can see that I am getting the correct csrf_token from CreateLoginFlow but I am still getting "403 forbidden security_csrf_violation - "The HTTP Cookie Header was set and a CSRF token was sent but they do not match." .. any idea how to fix this?
c
chilly-king-10285
04/04/2024, 10:33 AMA message from kapa.ai
chilly-king-10285
04/04/2024, 10:34 AMThe error message you're seeing suggests that the CSRF token you're sending in the request does not match the one set in the HTTP Cookie Header. This could be due to a number of reasons, but one common issue is not correctly forwarding the
CookieCookie Copy code
csharp export default (req: Request, res: Response) => { // ... .getLoginFlow({ id: flow, cookie: req.header("cookie") }) }Cookie<http://kratos.bar.com|kratos.bar.com><http://ui.bar.com|ui.bar.com><http://kratos.bar.com|kratos.bar.com><http://bar.com|bar.com><http://kratos.bar.com|kratos.bar.com><http://not-ar.com|not-ar.com>b
blue-alarm-98979
04/04/2024, 10:41 AM@chilly-king-10285 I am including the cookie header "var cookieHeader = ctx.Request.Headers["cookie"];" in the CreateBrowserLoginFlow and also in UpdateLoginFlow.. and now I am hosing kratos and my app at localhost.. any other ideas?
c
chilly-king-10285
04/04/2024, 10:41 AMA message from kapa.ai
chilly-king-10285
04/04/2024, 10:42 AMIt seems like you're doing the right things. However, there are a few more things you could check: 1. SameSite attribute: If you're running Ory Kratos in
--devSameSite=LaxSameSite=LaxsecurefalseSameSite=Lax--dev--devSecure--devkratos serve --devUpdateLoginFlowCreateBrowserLoginFlowUpdateLoginFlowUpdateLoginFlowCreateBrowserLoginFlowb
blue-alarm-98979
04/04/2024, 10:51 AM@chilly-king-10285 1. I run Kratos from terminal like "kratos serve -c <path_to_config_file>", so I dont think it is running in the dev mode.. 2. I am using https ... I also checked 3 and 4 and they are exactly the same
c
chilly-king-10285
04/04/2024, 10:51 AMA message from kapa.ai
chilly-king-10285
04/04/2024, 10:52 AMIt seems like you've covered most of the common issues. Here are a few more things you could try: 1. Check your configuration file: Ensure that your configuration file is correctly set up, especially the
urlsself.publicself.adminlog.level: debugcookieHeader