SSL/https从标头中删除X-CSRFToken [英] SSL/https removes X-CSRFToken from headers

问题描述

在安装SSL/https密钥后，将删除X-CSRFToken.我还设置了http2.在Https之前，一切正常，但是现在我得到了403，因为缺少CSRF令牌.找不到解决此特定问题的信息.感谢您的帮助.

support
  server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ssl on;
    server_name site.io www.site.io;

    # Use the Let's Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/site.io/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/site.io/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include /etc/nginx/snippets/ssl-params.conf;

    add_header Strict-Transport-Security max-age=500;

    access_log /home/nodejs/site.io/resuma_io_access.log;
    error_log /home/nodejs/site.io/resuma_io_error.log;
    root /home/nodejs/site.io/www/dist/client;

     location ~ ^/(api|user|auth|socket.io-client|sitemap.xml) {
          proxy_set_header   X-Real-IP            $remote_addr;
          proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
          proxy_set_header   X-Forwarded-Proto $scheme;
          proxy_set_header   Host                   $http_host;
          proxy_set_header   X-NginX-Proxy    true;
          proxy_set_header Upgrade $http_upgrade;
          proxy_ssl_session_reuse off;
          proxy_redirect off;
          proxy_set_header Connection 'upgrade';
          proxy_cache_bypass $http_upgrade;
          proxy_http_version 1.1;
          proxy_pass_header  X-CSRFToken;
          add_header X-Frame-Options SAMEORIGIN;
          sendfile  off;
          proxy_pass         http://nodejs_upstream;
        }
   }

解决方案

通读我对stackoverflow的最后一次搜索后，我发现了问题的真正原因. 就我而言，这不是标题问题，而是cookie的问题！ CSRFToken不在cookie中！

沃特·沃特(What Wtower)在 解决方案

Reading through my last search on stackoverflow I've found the real cause of the problem. In my case, it was not a header problem but a cookie one! CSRFToken was not in the cookie!

What Wtower answerd the 13/05/2015 on 403 Forbidden error when making an ajax Post request in Django framework is clearly explained.

CSRF_COOKIE_HTTPONLY = True in settings.py must be either removed or set to False!

If this is set to True, client-side JavaScript will not to be able to access the CSRF cookie!

这篇关于SSL/https从标头中删除X-CSRFToken的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！