"Error: invalid csrf token" in cobrowse console output
Can someone tell me why I get the below error message all the time in CoBrowse console output? I don't really find any issue in CoBrowse behaviour
Can someone tell me why I get the below error message all the time in CoBrowse console output? I don't really find any issue in CoBrowse behaviour
Wed, 20 Sep 2017 03:33:53 GMT express deprecated res.send(body, status): Use res.status(status).send(body) instead at config/custom-middleware.js:65:13
Error: invalid csrf token
at verifytoken (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/csurf/index.js:234:13)
at csrf (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/csurf/index.js:94:7)
at exports.customCsrf (/home/ec2-user/Installables/PegaCoBrowse/server/config/custom-middleware.js:154:3)
at Layer.handle [as handle_request] (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/layer.js:76:5)
at trim_prefix (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:270:13)
at /home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:237:9
at Function.proto.process_params (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:312:12)
at /home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:228:12
at Function.match_layer (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:295:3)
at next (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:189:10)
at methodOverride (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/method-override/index.js:77:5)
at Layer.handle [as handle_request] (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/layer.js:76:5)
at trim_prefix (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:270:13)
at /home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:237:9
at Function.proto.process_params (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:312:12)
at /home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:228:12
at Function.match_layer (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:295:3)
at next (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express/lib/router/index.js:189:10)
at MongoStore.<anonymous> (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/express-session/index.js:377:7)
at MongoStore.tryCatcher (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/connect-mongo/node_modules/bluebird/js/release/util.js:11:23)
at Promise.successAdapter [as _fulfillmentHandler0] (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/connect-mongo/node_modules/bluebird/js/release/nodeify.js:23:30)
at Promise._settlePromise (/home/ec2-user/Installables/PegaCoBrowse/server/node_modules/connect-mongo/node_modules/bluebird/js/release/promise.js:545:21)
***Updated by moderator: Lochan to update Categories***
**Moderation Team has archived post**
This post has been archived for educational purposes. Contents and links will no longer be updated. If you have the same/similar question, please write a new post.
Accepted Solution
Pegasystems Inc.
IN
local change given for this SR:
Please provide a proper url for the log server.
Log server can be start with the HTTP only. To use HTTPS configure HTTPS on proxy server.
For ex: log server is running on def.abc.xy.z:2000 and proxy server url is https://cobrowse.abc.xy.z then configure proxy for the https://cobrowse.abc.xy.z/logServer forward request to def.abc.xy.z:2000.
Provide end logserver url as part of config.json i.e. https://cobrowse.abc.xy.z/logServer
Pegasystems Inc.
IN
This might be an CSRF issue have you enabled below CSRF DSS settings
security/csrf/securedActivities
security/csrf/securedStreams
security/csrf/mode
security/csrf/validreferers
what is the pega version you are using and have you ran any security tool for vulnerabilities of your application.
Thanks,
Narasimha
Accenture
AU
Hi Narasimha,
We use pega 7.2.1 and pega CoBrowse 7.22.5. We have not run any security tool for vulnerabilities.
I do not find security/csrf folder.
I can see "server/node_modules/csurf/node_modules/csrf" and "recordingServer/services/security". We are not using recording server It is marked as false
Pegasystems Inc.
IN
Hi SreethiG,
You see these CSRF token errors on server console because there are some client browsers whose cookies are holding invalid CSRF token value. Every time such clients hit the Co-Browse server URL their CSRF token fails validation and this error is shown both at the client side as well as in the server console. To get rid of this please clear the cookies on client side that are getting this problem.
If even this doesn't work we need to understand if you are using a load balancer in your deployment setup. If so the load balancer configurations should be validated by following the below steps.
We would suggest to make the following changes only in your QA/DEV setups and not in Production, as these changes are for debugging purposes only:
- Open custom-middleware.js file, at "cobrowsing/server/config/custom-middleware.js" location and find "customCsrf" method, add below lines:
console.log("CB Url ------ ", serverHostUrl);
console.log("LB Url ------ ", req.url);
2. Restart the node server.
3. Open browser and hit the server host url.
4. Go to the node server console and check the URLs.
Now the CB Url should be a prefix to LB Url, for example:
CB Url: https://example.com/xyz/abc
LB Url: /xyz/abc/session/new
Hi SreethiG,
You see these CSRF token errors on server console because there are some client browsers whose cookies are holding invalid CSRF token value. Every time such clients hit the Co-Browse server URL their CSRF token fails validation and this error is shown both at the client side as well as in the server console. To get rid of this please clear the cookies on client side that are getting this problem.
If even this doesn't work we need to understand if you are using a load balancer in your deployment setup. If so the load balancer configurations should be validated by following the below steps.
We would suggest to make the following changes only in your QA/DEV setups and not in Production, as these changes are for debugging purposes only:
- Open custom-middleware.js file, at "cobrowsing/server/config/custom-middleware.js" location and find "customCsrf" method, add below lines:
console.log("CB Url ------ ", serverHostUrl);
console.log("LB Url ------ ", req.url);
2. Restart the node server.
3. Open browser and hit the server host url.
4. Go to the node server console and check the URLs.
Now the CB Url should be a prefix to LB Url, for example:
CB Url: https://example.com/xyz/abc
LB Url: /xyz/abc/session/new
If the URLs are not as expected then the Load Balancer configuration needs to be adjusted to point to the correct Co-Browse server URL.
Accenture
AU
Hi,
We get difference in CB and LB URL. Attached are the screen shots of console output before initiating cobrowsing and after initiating.
We are using F5 to route the traffic to cobrowsing servers. Can you tell me what changes to be made in F5 to correct this?
Pegasystems Inc.
IN
Hi SreethiG,
From the console logs it appears that you have not configured any additional context path in Co-Browse server and so the logs printed are as expected. I need some more information on this:
1. Does the CSRF exception keep printing on the console repeatedly irrespective of you opening the Co-Browse dashboard in a browser?
2. If not, can you launch the Co-Browse dashboard in "Incognito" mode on chrome and see if the same problem persists.
Accenture
AU
Hi,
1. We don't get the error unless we open the customer page which has CoBrowse snippet or the CoBrowse dashboard
2. We get the error even if we open CoBrowse dashboard in "Incognito" mode in chrome
Pegasystems Inc.
IN
Hi Sreethi,
After an internal discussion on this post, it is determined that an SR would be the best route to take this forward as this needs someone to look into the system with you. Please create an SR and let us know the SR number back here. Make sure to reference this discussion URL while creating the SR to ensure faster troubleshooting.
Regards,
Pegasystems Inc.
IN
Thank you!
I see that you have added the URL of this post in the SR. I have added an additional note to the Engineer.
Accepted Solution
Pegasystems Inc.
IN
local change given for this SR:
Please provide a proper url for the log server.
Log server can be start with the HTTP only. To use HTTPS configure HTTPS on proxy server.
For ex: log server is running on def.abc.xy.z:2000 and proxy server url is https://cobrowse.abc.xy.z then configure proxy for the https://cobrowse.abc.xy.z/logServer forward request to def.abc.xy.z:2000.
Provide end logserver url as part of config.json i.e. https://cobrowse.abc.xy.z/logServer