https://www.ory.sh/ logo
Join Slack
Powered by
I am getting a CSRF error for `/admin/session/.../...
# talk-kratos
w
I am getting a CSRF error for 
/admin/session/.../extend
, with the following details:
Copy code
{
  "docs": "<https://www.ory.sh/kratos/docs/debug/csrf>",
  "hint": "The anti-CSRF cookie was found but the CSRF token was not included in the HTTP request body (csrf_token) nor in the HTTP Header (X-CSRF-Token).",
  "reject_reason": "The HTTP Cookie Header was set and a CSRF token was sent but they do not match. We recommend deleting all cookies for this domain and retrying the flow."
}
This is self hosted kratos. I am so confused, other routes work as expected, any idea?
a
Take a look and see if you're sending the field with that name 
csrf_token
in the form. When creating the form, you should create a hidden field with that name and the value that Kratos provides in the nodes section.
w
there is no form 🤔 it's the admin route for extension, it just takes a session id.
V0alpha2Api.adminExtendSession(id: string, options?: AxiosRequestConfig): Promise<AxiosResponse<Session>>
a
Oh, you´re using the SDK... I don't have experience there, sorry
w
Well but the admin extend route doesn't take any form in the API either... https://www.ory.sh/docs/kratos/reference/api#operation/adminExtendSession
r
Form is relative, could be form data. But I see it should be just 
PATCH
. Can you try the curl example to see if it works with sdk?
I had to update the sdk yesterday, maybe something changed too. I would try that. I mean depending on your version of Kratos.
e
@white-article-28775 which SDK are you using?
w
The latest 
@ory/client
and 
@ory/integrations
on npm
e
@white-article-28775 do you have the code block for your SDK request?
w
It's literally just 
ory.adminExtendSession(sessionId)
e
How did you set up the client 
ory
?
w
With the edge config from 
@ory/integrations
, i did the same thing as in the nextjs examle
e
Can you send the config? I'm not familiar with it
w
It really doesn't have anything... it's just
it's just
Copy code
const edgeConfig = {
  basePath: "/api/.ory",
  baseOptions: {
    withCredentials: true
  }
};
e
honestly I'm essentially dealing with a similar issue, I believe you need to pass the PAT to the request since its an admin endpoint
I suggest trying to get in contact with ory staff
w
See, the problem is, we also use another admin point (delete identity), and that one works fine 🤷
e
That is weird if another admin point is working...
w
Yep...
Should I just tag one f the devs? x_x
e
Yes, perhaps make a new thread since this one is a bit "messy" 😛
71 Views
Open in Slack
PreviousNext
Powered by