Invalid CSRF on dev install

[phenomlab]

I wanted to create a DEV instance of sudonix, so went ahead and registered sudonix.dev, installed NodeBB, then recovered the database.

All good - apart from the fact that I consistently got the dreaded csrf invalid message…

Here’s the log extract

2022-03-21T14:15:25.859Z [4571/91294] - info: Initializing NodeBB v1.19.5 https://sudonix.dev
2022-03-21T14:15:27.761Z [4571/91294] - info: [socket.io] Restricting access to origin: https://sudonix.dev:*
2022-03-21T14:15:27.858Z [4571/91294] - warn: [plugins] "@nodebb/nodebb-plugin-user-level" is active but not installed.
(node:91294) Warning: Accessing non-existent property 'padLevels' of module exports inside circular dependency
(Use `node --trace-warnings ...` to show where the warning was created)
2022-03-21T14:15:28.637Z [4571/91294] - warn: [plugins/load] DEPRECATION The hook filter:router.page has been deprecated as of v1.15.3, and slated for removal in v2.1.0. Please use response:router.page instead. The following plugins are still listening for this hook:
  * nodebb-plugin-write-api
2022-03-21T14:15:28.724Z [4571/91294] - info: [plugins/spam-be-gone] Settings loaded
2022-03-21T14:15:28.734Z [4571/91294] - info: [reputation-rules] settings loaded
2022-03-21T14:15:28.925Z [4571/91294] - info: [api] Adding 4 route(s) to `api/v3/plugins`
2022-03-21T14:15:28.936Z [4571/91294] - info: [router] Routes added
2022-03-21T14:15:28.947Z [4571/91294] - info: NodeBB Ready
2022-03-21T14:15:28.948Z [4571/91294] - info: Enabling 'trust proxy'
2022-03-21T14:15:28.950Z [4571/91294] - info: NodeBB is now listening on: 0.0.0.0:4571
2022-03-21T14:15:47.488Z [4571/91294] - error: [plugin/iframely] Could not parse embed: Failed to lookup view "partials/iframely-widget-card" in views directory "/home/sudonix.dev/nodebb/build/public/templates". Url: https://sudonix.com/topic/233/nodebb-welcome-message-with-logo-footer-change/3?_=1645445273209
Missing translation "2factor:title" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_unsolved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:topic_solved" for language "en-GB"
Missing translation "qanda:menu.solved" for language "en-GB"
Missing translation "qanda:menu.solved" for language "en-GB"
2022-03-21T14:15:48.899Z [4571/91294] - error: POST /logout
invalid csrf token

Tried clearing cache, no dice. Tried incognito mode, no dice.

After some significant head scratching, it suddenly dawned on me that the cookie domain would need to be reset as this is a PROD database replica in a new domain.

To do this.

1. Open the mondogb console
2. Select your database - in my case use sudonixdev;
3. Issue this command db.objects.update({_key: "config"}, {$set: {cookieDomain: ""}});
4. Restart nodebb

Problem solved - able to login

[小城风雨多]

This post helped me in August.

Now that I have migrated the server, this topic appears again, and the command no longer works.

Do you know what causes this problem? How to avoid it?

[phenomlab]

@小城风雨多 The command should still work. What is the output?

[小城风雨多]

@phenomlab

Environment

mongoDB version: 6.0.11
nodebb version: 3.4.3

Description

renew install nodebb application and whole server machine, use mongodump backup and restored mongoDB data.
Then I got this.

Detail

server nodebb log when I tried to login and register

2023-11-03T08:55:23.895Z [4567/5442] - error: POST /login
invalid csrf token
2023-11-03T08:55:44.204Z [4567/5442] - error: POST /register
invalid csrf token

executed mongo command then print

nodebb> db.objects.update({_key: "config"}, {$set: {cookieDomain: ""}});
DeprecationWarning: Collection.update() is deprecated. Use updateOne, updateMany, or bulkWrite.
{
  acknowledged: true,
  insertedId: null,
  matchedCount: 1,
  modifiedCount: 0,
  upsertedCount: 0
}

nodebb> db.objects.updateOne({ _key: "config" }, { $set: { cookieDomain: "" } })
{
  acknowledged: true,
  insertedId: null,
  matchedCount: 1,
  modifiedCount: 0,
  upsertedCount: 0
}

match 1 result, but modifed 0.

PS

I’m sorry I didn’t post the detailed information before, and I’m very grateful for your timely reply to my message.
Now I have bound the email address for my account, and the follow-up news should be notified in time.

[小城风雨多]

@小城风雨多

Occasionally I tried to change the url in config.json from https to http.
It works!

Amazing!

Thanks a lot!

[phenomlab]

@小城风雨多 Looking at the above, it seems you are missing the command to use nodebb for example. Otherwise, you are running the command against the admin database Made that mistake myself before…

[DownPW]

I have the same problem :

DeprecationWarning: Collection.update() is deprecated. Use updateOne, updateMany, or bulkWrite.

https://sudonix.org/assets/uploads/files/1731797498337-c502c3bd-edb9-4cbb-9dd1-f08149017d8d-image.png

[phenomlab]

@DownPW Did you try the response from @小城风雨多 ?

[DownPW]

Yep

[phenomlab]

@DownPW which version of MongoDB are you using?