The

security_csrf_violation

error can occur due to a few reasons: 1. Cross-Site Request Forgery (CSRF) Protection: Ory provides CSRF protection for all flows. This means that you must send a CSRF token in the body and CSRF cookie back when submitting a flow. The cookie should be sent by default by your browser, but you must add the CSRF token manually to the request body. This can be a JSON object or a native form POST. When mapping UI nodes, take note of input fields with the name

csrf_token

with the

hidden

attribute. If the CSRF token is not correctly included in the request, it could lead to a

security_csrf_violation

error. [source](https://www.ory.sh/docs/kratos/bring-your-own-ui/custom-ui-basic-integration#csrf-errors) 2. Public Suffix Domains: If you're using a domain that's on the public suffix list (PSL), it's not possible to set cookies on a domain that's on the PSL. This could lead to a

security_csrf_violation

error. To fix this, you need to use a sub-domain that's not on the PSL. [source](https://www.ory.sh/docs/troubleshooting/csrf#public-suffix-domains) 3. Cross-Origin Resource Sharing (CORS): These requests are allowed only if the server responds with the appropriate CORS headers and the JavaScript XHR request is made with

credentials: 'include'

. If the server does not respond with the appropriate CORS headers, it could lead to a

security_csrf_violation

error. [source](https://www.ory.sh/docs/security-model#same-top-level-domain) Please ensure that you have correctly implemented CSRF protection, are not using a domain on the PSL, and have correctly configured CORS.

The error message you're seeing indicates that while the anti-CSRF cookie was found, the CSRF token was not included in the HTTP request body or in the HTTP Header. In Ory, CSRF protection is provided for all flows. This means that you must send a CSRF token in the body and CSRF cookie back when submitting a flow. The CSRF token value is a hidden input field called

csrf_token

. Here's an example of how to include the CSRF token in a request body:

javascript {   "method": "password",   "csrf_token": "your-csrf-token",   "identifier": "<mailto:user@example.com|user@example.com>",   "password": "verystrongpassword" }

In this example, replace

"your-csrf-token"

with the actual CSRF token you received. If you're using a Single Page Application (SPA), make sure that you're correctly extracting the CSRF token from the hidden input field and including it in your request body or header. For more information, refer to the [Ory documentation on CSRF errors](https://www.ory.sh/docs/kratos/bring-your-own-ui/custom-ui-basic-integration#csrf-errors).

New message text here