My Node App has a page where users can submit their email address to login. When I deploy the app to production, it works fine initially. However, after some time, I start receiving a 403 Forbidden error like the following:
Express
403 Error: Forbidden
at Object.exports.error (/opt/run/snapshot/package/node_modules/express/node_modules/connect/lib/utils.js:63:13)
at createToken (/opt/run/snapshot/package/node_modules/express/node_modules/connect/lib/middleware/csrf.js:82:55)
at /opt/run/snapshot/package/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:7
at Object.ondone (/opt/run/snapshot/package/node_modules/express/node_modules/connect/node_modules/uid2/index.js:46:8)
The log shows the following error message:
err Sun, 09 Mar 2014 11:52:01 GMT Error: Forbidden
at Object.exports.error (/opt/run/snapshot/package/node_modules/express/node_modules/connect/lib/utils.js:63:13)
at createToken (/opt/run/snapshot/package/node_modules/express/node_modules/connect/lib/middleware/csrf.js:82:55)
at /opt/run/snapshot/package/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:7
at Object.ondone (/opt/run/snapshot/package/node_modules/express/node_modules/connect/node_modules/uid2/index.js:46:8)
Restarting the app without making any changes to the code fixes the login issue temporarily. It seems like there may be an issue with the csrf token expiring. I am certain that I am passing a csrf token on the login page as I can verify it in the page source.
I am currently using node version 0.10 and contemplating reverting back to 0.8.
Below is my app configuration:
app.configure(function(){
app.set('views', __dirname + '/views');
app.set('view engine','ejs');
app.use(express.logger('dev'));
app.use(express.bodyParser());
app.use(helmet.xframe());
app.use(helmet.iexss());
app.use(helmet.contentTypeOptions());
app.use(helmet.cacheControl());
app.use(express.cookieParser());
app.use(express.session({
secret: "**********************",
cookie: {
maxAge : 3600000, //1 hours
expires : new Date(Date.now() + 3600000), //2 Hours
},
store: new MongoStore({
mongoose_connection: mongoose.connection
})
})
);
//app.use(express.cookieSession({secret:"fooseball123!"}));
app.use(express.csrf());
//middleware to make csrf token available
app.use(function (req, res, next) {
//res.locals.token = req.session._csrf;
res.locals.token = req.csrfToken();
next();
});
app.use(express.compress());
app.use(app.router);
app.use(express.static(__dirname + '/public', {maxAge: 86400000}));
app.use(express.errorHandler());
});