connect Module, Error: Forbidden #702

akhoury · 2013-12-30T05:25:51Z

occasionally, I see this, it doesn't crash NodeBB, but it annoys me

info: [Auth] Session -R2aX7ifnT_L6bQ7vHUcXFqV logout (uid: 1)
Error: Forbidden
    at Object.exports.error (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/utils.js:60:13)
    at Object.handle (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.session [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/session.js:302:7)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.cookieParser [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
Error: Forbidden
    at Object.exports.error (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/utils.js:60:13)
    at Object.handle (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.session [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/session.js:302:7)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.cookieParser [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
Error: Forbidden
    at Object.exports.error (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/utils.js:60:13)
    at Object.handle (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.session [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/session.js:302:7)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.cookieParser [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
Error: Forbidden
    at Object.exports.error (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/utils.js:60:13)
    at Object.handle (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.session [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/session.js:302:7)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.cookieParser [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
Error: Forbidden
    at Object.exports.error (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/utils.js:60:13)
    at Object.handle (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.session [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/session.js:302:7)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.cookieParser [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
Error: Forbidden
    at Object.exports.error (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/utils.js:60:13)
    at Object.handle (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.session [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/session.js:302:7)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.cookieParser [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
info: [Auth] Session -R2aX7ifnT_L6bQ7vHUcXFqV logout (uid: 2)

Want to back this issue? Place a bounty on it! We accept bounties via Bountysource.

julianlam · 2013-12-30T05:44:42Z

You're not the only one, I've seen reports of it on IRC as well. However, we have never been able to narrow it down to a specific set of reproduction steps, so that is a prerequisite before we can begin triaging this CSRF error.

akhoury · 2013-12-30T17:34:17Z

fyi- it may have caused a memory issue, or it could be something else leaking, not sure yet,

Error: Forbidden
    at Object.exports.error (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/utils.js:60:13)
    at Object.handle (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.session [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/session.js:302:7)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.cookieParser [as handle] (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/admin/NodeBB/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
FATAL ERROR: CALL_AND_RETRY_2 Allocation failed - process out of memory

julianlam · 2013-12-30T17:46:47Z

Just thinking out loud... It could be related to long sessions... The CSRF
token changes each time it is used (to prevent repeat attacks, I'd
imagine), so if someone were still on NodeBB after the token has changed,
it would result in these kinds of errors...

barisusakli · 2013-12-30T18:50:59Z

So it would happen if you change code on server side and supervisor restarts causing the csrf change, then if you don't reload browser and make an ajax call it would say forbidden?

julianlam · 2013-12-30T18:51:37Z

Yes, this would do it.

akhoury · 2013-12-30T18:55:50Z

this would do it, but it's not exclusive, I just saw again now, while tailing forever log, no restart occurred, no code change either :/

akhoury · 2014-01-07T18:04:49Z

this is spamming logs overnight :/ logs and at some point NodeBB becomes unresponsive with no error in the logs
i had to forever restartall

barisusakli · 2014-01-07T18:50:07Z

I wonder if it has something to do with express/connect versions, we didn't had this problem couple months ago.

barisusakli · 2014-01-07T18:51:28Z

https://github.com/senchalabs/connect/blob/master/lib/middleware/csrf.js#L82

Is what is sending the 403 maybe put some console.logs there to see the token/val.

julianlam · 2014-01-07T19:05:29Z

Looks like express changed the way CSRF token were handled? Gee, thanks, I thought this was exactly what semver was supposed to protect against.

I'm not impressed.

barisusakli · 2014-01-07T19:11:02Z

http://stackoverflow.com/questions/20484649/csrf-token-not-working-when-submitting-form-in-express heh not sure if this will fix it but worth a shot

julianlam · 2014-01-07T19:12:58Z

May as well update package.json to express ~3.4.7

akhoury · 2014-01-07T20:10:09Z

will try that tonight thanks

akhoury · 2014-01-09T07:00:41Z

no luck with express ~3.4.7 solving these errors, but hoping for the weird slow responsiveness to go away.

barisusakli · 2014-01-09T07:35:07Z

Time to post at https://github.com/visionmedia/express/issues 😄

barisusakli · 2014-01-09T07:46:33Z

Not sure if this is it but we put the csrf token in the header.tpl in nodebb and then it doesn't change at all until the page is refreshed? Aren't we supposed to get a new one for each post request?

Also might be relevant :
senchalabs/connect#866

julianlam · 2014-01-09T19:55:57Z

Also tried upgrading to 3.4.7, and am getting req.session._csrf is deprecated, use req.csrfToken() instead, which is peculiar, because I removed the only reference to req.session._csrf. It's possible one of our dependencies is using it, but a cursory search of node_modules didn't find anything.

barisusakli · 2014-01-09T20:03:22Z

I read that it is the JSON.stringify in the session middleware. expressjs/express#1741

barisusakli · 2014-01-21T19:55:24Z

@akhoury are you by any chance on any other nodebb instances when this happens?

akhoury · 2014-01-21T20:02:16Z

hmm well, yea, i've seen it locally too.

My not be related, but my current solution is a cron job that restarts the forum every hour :/ - im loosing memory somewhere.

I'm still on 0.2.1 in Production, I see you pushed this issue to 0.3.1, good, waiting for 0.3.0. I'm going to update then i'll feed you back.

akhoury · 2014-01-27T01:57:07Z

still happening

barisusakli · 2014-01-27T02:58:46Z

senchalabs/connect@138b21c some interesting discussions there. Can you try lowering your max age on cookies to a few minutes and try to get the errors again?

akhoury · 2014-01-27T03:14:45Z

sure

barisusakli · 2014-02-14T16:17:47Z

Could this be the apple icon see #977
Since requests to that file didnt have the session maybe csrf check was failing for all those requests?

julianlam · 2014-02-14T16:20:45Z

Doubtful -- CSRF doesn't trigger on GETs...

Refactoring so that CSRF is added in a middleware may be better (since we
use it so sparingly anyway)

Thanks,

Julian Lam

On Fri, Feb 14, 2014 at 11:17 AM, Barış Soner Uşaklı <
notifications@github.com> wrote:

Could this be the apple icon see #977 #977
Since requests to that file didnt have the session maybe csrf check was
failing for all those requests?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/702#issuecomment-35098075
.

julianlam · 2014-02-20T02:34:29Z

Just wondering... @akhoury, are you still seeing these errors?

akhoury · 2014-02-20T03:04:43Z

a lot less frequent, im going to say 2-3 times per day based on a quick scan of the logs.
but im on 0.3.1

jsanchezramos · 2014-04-02T14:06:21Z

Hello, I'm implementing a lti module and I feel the same, is there any solution?.

thanks

julianlam · 2014-07-30T11:55:17Z

Since express 4 rolled around and was implemented, does this happen, still?

julianlam modified the milestones: 0.3.2, 0.4.0 Feb 3, 2014

julianlam mentioned this issue Feb 9, 2014

v_in.log: Error: Forbidden #970

Closed

julianlam modified the milestones: 0.4.1, 0.3.2 Feb 14, 2014

barisusakli mentioned this issue Feb 14, 2014

Redis error - User & Topic unaccessible #1018

Closed

julianlam modified the milestones: 0.4.0, 0.4.1 Feb 18, 2014

akhoury mentioned this issue Feb 21, 2014

Error: Forbidden #1082

Closed

barisusakli modified the milestones: 0.4.1, 0.4.0 Mar 13, 2014

barisusakli modified the milestones: 0.5.0, 0.4.2 Apr 28, 2014

barisusakli modified the milestones: 0.5.1, 0.5.0 Jun 10, 2014

barisusakli modified the milestones: 0.5.2, 0.5.1 Sep 17, 2014

barisusakli closed this as completed Oct 10, 2014

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

connect Module, Error: Forbidden #702

connect Module, Error: Forbidden #702

akhoury commented Dec 30, 2013

julianlam commented Dec 30, 2013

akhoury commented Dec 30, 2013

julianlam commented Dec 30, 2013

barisusakli commented Dec 30, 2013

julianlam commented Dec 30, 2013

akhoury commented Dec 30, 2013

akhoury commented Jan 7, 2014

barisusakli commented Jan 7, 2014

barisusakli commented Jan 7, 2014

julianlam commented Jan 7, 2014

barisusakli commented Jan 7, 2014

julianlam commented Jan 7, 2014

akhoury commented Jan 7, 2014

akhoury commented Jan 9, 2014

barisusakli commented Jan 9, 2014

barisusakli commented Jan 9, 2014

julianlam commented Jan 9, 2014

barisusakli commented Jan 9, 2014

barisusakli commented Jan 21, 2014

akhoury commented Jan 21, 2014

akhoury commented Jan 27, 2014

barisusakli commented Jan 27, 2014

akhoury commented Jan 27, 2014

barisusakli commented Feb 14, 2014

julianlam commented Feb 14, 2014

julianlam commented Feb 20, 2014

akhoury commented Feb 20, 2014

jsanchezramos commented Apr 2, 2014

julianlam commented Jul 30, 2014

connect Module, Error: Forbidden #702

connect Module, Error: Forbidden #702

Comments

akhoury commented Dec 30, 2013

julianlam commented Dec 30, 2013

akhoury commented Dec 30, 2013

julianlam commented Dec 30, 2013

barisusakli commented Dec 30, 2013

julianlam commented Dec 30, 2013

akhoury commented Dec 30, 2013

akhoury commented Jan 7, 2014

barisusakli commented Jan 7, 2014

barisusakli commented Jan 7, 2014

julianlam commented Jan 7, 2014

barisusakli commented Jan 7, 2014

julianlam commented Jan 7, 2014

akhoury commented Jan 7, 2014

akhoury commented Jan 9, 2014

barisusakli commented Jan 9, 2014

barisusakli commented Jan 9, 2014

julianlam commented Jan 9, 2014

barisusakli commented Jan 9, 2014

barisusakli commented Jan 21, 2014

akhoury commented Jan 21, 2014

akhoury commented Jan 27, 2014

barisusakli commented Jan 27, 2014

akhoury commented Jan 27, 2014

barisusakli commented Feb 14, 2014

julianlam commented Feb 14, 2014

julianlam commented Feb 20, 2014

akhoury commented Feb 20, 2014

jsanchezramos commented Apr 2, 2014

julianlam commented Jul 30, 2014