Error while depositing record: CSRF token missing or incorrect.

[hansvancalster]

I have the following issue as illustrated by this reprex:

zenodo <- zen4R::ZenodoManager$new(
  token = keyring::key_get("ZENODO_SANDBOX"),
  sandbox = TRUE,
  logger = "DEBUG"
)

rec <- zenodo$createEmptyRecord()
#> ✖ Error while depositing record: Permission denied.
#> [zen4R][ERROR] ZenodoManager - Error while depositing record: Permission denied.

^{Created on 2025-10-02 with reprex v2.1.1}

Standard output and standard error

-> POST /api/records HTTP/1.1
-> Host: zenodo-rdm-qa.web.cern.ch
-> Accept-Encoding: deflate, gzip
-> Cookie: 996c8b1133ad3a837a97fe16a8ef2144=03fa5ceb2b1ed092f4df35a38a7c1cc9
-> User-Agent: zen4R_0.10.3
-> Authorization: Bearer *********************************************
-> Content-Type: application/json
-> Accept: application/vnd.inveniordm.v1+json
-> Content-Length: 2
-> 
>> {}
<- HTTP/1.1 403 FORBIDDEN
<- server: nginx
<- date: Thu, 02 Oct 2025 10:26:45 GMT
<- content-type: application/json
<- content-length: 48
<- access-control-allow-origin: *
<- access-control-expose-headers: Content-Type, ETag, Link, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset
<- set-cookie: csrftoken=eyJhbGciOiJIUzUxMiIsImlhdCI6MTc1OTQwMDgwNSwiZXhwIjoxNzU5NDg3MjA1fQ.InNuNHJkeGNKNW90N1NZbHpXSFpDV2RuUmlybXl1MW5jIg.QAIYtjTlT5KvgkXibh0RH5qa1OPVmFT8OX25pPfE_rpIpLXUkXQpfClwaomJQujwb5AtF0RmKM1c2IbRC8fcbw; Expires=Thu, 09 Oct 2025 10:26:45 GMT; Max-Age=604800; Secure; Path=/; SameSite=Lax
<- x-ratelimit-limit: 133
<- x-ratelimit-remaining: 131
<- x-ratelimit-reset: 1759400866
<- retry-after: 60
<- permissions-policy: interest-cohort=()
<- x-frame-options: sameorigin
<- x-xss-protection: 1; mode=block
<- x-content-type-options: nosniff
<- content-security-policy: default-src 'self' fonts.googleapis.com *.gstatic.com data: 'unsafe-inline' 'unsafe-eval' blob: zenodo-broker.web.cern.ch zenodo-broker-qa.web.cern.ch maxcdn.bootstrapcdn.com cdnjs.cloudflare.com ajax.googleapis.com webanalytics.web.cern.ch
<- strict-transport-security: max-age=31556926; includeSubDomains
<- referrer-policy: strict-origin-when-cross-origin
<- 
ERROR: Unknown command "TMPDIR=C:/Users/hans_vancalster/AppData/Local/Temp/Rtmp67NK6R/file5a004b8e613c". Did you mean command "uninstall"?

Session info

sessioninfo::session_info()
#> Warning in system2("quarto", "-V", stdout = TRUE, env = paste0("TMPDIR=", :
#> running command '"quarto"
#> TMPDIR=C:/Users/hans_vancalster/AppData/Local/Temp/Rtmp67NK6R/file5a004b8e613c
#> -V' had status 1
#> ─ Session info ───────────────────────────────────────────────────────────────
#>  setting  value
#>  version  R version 4.5.1 (2025-06-13 ucrt)
#>  os       Windows 11 x64 (build 26100)
#>  system   x86_64, mingw32
#>  ui       RTerm
#>  language (EN)
#>  collate  Dutch_Belgium.utf8
#>  ctype    Dutch_Belgium.utf8
#>  tz       Europe/Brussels
#>  date     2025-10-02
#>  pandoc   3.4 @ C:/Program Files/RStudio/resources/app/bin/quarto/bin/tools/ (via rmarkdown)
#>  quarto   NA @ C:\\PROGRA~1\\RStudio\\RESOUR~1\\app\\bin\\quarto\\bin\\quarto.exe
#> 
#> ─ Packages ───────────────────────────────────────────────────────────────────
#>  package     * version   date (UTC) lib source
#>  cli           3.6.5     2025-04-23 [1] CRAN (R 4.5.0)
#>  curl          6.4.0     2025-06-22 [1] CRAN (R 4.5.1)
#>  digest        0.6.37    2024-08-19 [1] CRAN (R 4.5.0)
#>  evaluate      1.0.4     2025-06-18 [1] CRAN (R 4.5.1)
#>  fastmap       1.2.0     2024-05-15 [1] CRAN (R 4.5.0)
#>  fs            1.6.6     2025-04-12 [1] CRAN (R 4.5.0)
#>  glue          1.8.0     2024-09-30 [1] CRAN (R 4.5.0)
#>  htmltools     0.5.8.1   2024-04-04 [1] CRAN (R 4.5.0)
#>  httr          1.4.7     2023-08-15 [1] CRAN (R 4.5.0)
#>  jsonlite      2.0.0     2025-03-27 [1] CRAN (R 4.5.0)
#>  keyring       1.4.1     2025-06-15 [1] CRAN (R 4.5.1)
#>  knitr         1.50      2025-03-16 [1] CRAN (R 4.5.0)
#>  lifecycle     1.0.4     2023-11-07 [1] CRAN (R 4.5.0)
#>  plyr          1.8.9     2023-10-02 [1] CRAN (R 4.5.0)
#>  R6            2.6.1     2025-02-15 [1] CRAN (R 4.5.0)
#>  Rcpp          1.1.0     2025-07-02 [1] CRAN (R 4.5.1)
#>  reprex        2.1.1     2024-07-06 [1] CRAN (R 4.5.0)
#>  rlang         1.1.6     2025-04-11 [1] CRAN (R 4.5.0)
#>  rmarkdown     2.29      2024-11-04 [1] CRAN (R 4.5.0)
#>  rstudioapi    0.17.1    2024-10-22 [1] CRAN (R 4.5.0)
#>  sessioninfo   1.2.3     2025-02-05 [1] CRAN (R 4.5.0)
#>  utf8          1.2.6     2025-06-08 [1] CRAN (R 4.5.1)
#>  withr         3.0.2     2024-10-28 [1] CRAN (R 4.5.0)
#>  xfun          0.53      2025-08-19 [1] CRAN (R 4.5.1)
#>  XML           3.99-0.18 2025-01-01 [1] CRAN (R 4.5.0)
#>  xml2          1.3.8     2025-03-14 [1] CRAN (R 4.5.0)
#>  yaml          2.3.10    2024-07-26 [1] CRAN (R 4.5.0)
#>  zen4R         0.10.3    2025-08-18 [1] https://inbo.r-universe.dev (R 4.5.1)
#> 
#>  [1] C:/R/library
#>  [2] C:/R/R-4.5.1/library
#> 
#> ──────────────────────────────────────────────────────────────────────────────

If you click "Standard output and standard error" the DEBUG logger is shown.
This is all very obscure to me, but when I asked this to Claude AI, it gave me the following diagnosis:

The error message indicates "CSRF token missing or incorrect" - this is a Cross-Site Request Forgery protection issue.
Looking at your request, I can see:

You have a CSRF token in the Cookie header (the csrftoken JWT)
But you're not sending it in the request header where the server expects it

The Fix
You need to include the CSRF token in the request headers. Typically, InvenioRDM (which Zenodo uses) expects the CSRF token to be sent in one of these headers:

X-CSRFToken (most common)
X-CSRF-Token

The token value should be extracted from the csrftoken cookie and sent as a header.
What zen4R needs to do:
The zen4R package needs to:

Extract the CSRF token from the cookie response
Include it in subsequent requests as a header like: X-CSRFToken: <token_value>

The token value would be:
eyJhbGciOiJIUzUxMiIsImlhdCI6MTc1OTM5ODQyMiwiZXhwIjoxNzU5NDg0ODIyfQ.IndzRkp5VXJHckdVbmFPV2VoalZJY0tDdUxEaTlTbWJ3Ig.WdTbUqk5pJkPnf9vGdktMfxbAmCuV9632PaI6-z67pC1pPJvJiR4VhfJeXnc7MwcD94uKtwPrVlnEVcl6M6LtA
This is a known requirement when making state-changing requests (POST, PUT, DELETE) to InvenioRDM instances. The package maintainer would need to update the code to handle CSRF token management properly.

I tried updating the zenodo sandbox token first, but to no avail.
This the version of zen4R that I used:

Package: zen4R
Version: 0.10.3
Date: 2025-08-13

Hope you can shed some light on this.

[eblondel]

CSRF token is not managed by user. Zenodo API provides you a token for usage in the API, and you should stick with this token (Be careful with the kind of reply you could get from AI which may get you on wrong paths)

The API returns you a "permission denied", with a status code 403 Forbidden. This means your token doesn't exist or doesn't allow for deposit. BTW, You have shared a debug report that shows headers, and then your token was exposed. I've masked it, but I would advise you delete that one and generate a new one.

You need to make sure:

• the token has been generated in the Zenodo Sandbox. Some users think the token they generate in the production Zenodo (https://zenodo.org) is valid for the Sandbox. It's not. These are 2 separate platforms, so if you want to use the Sandbox, you need to generate a token in the sandbox platform: https://sandbox.zenodo.org
• the token is granted for deposits privileges. Basically check all the deposit boxes proposed in the Zenodo interface when creating the token, as follow:

The Zenodo sandbox is likely to be unstable, and by experience, there might be unexpected and random issues with this test infra due to Zenodo infra testing or because of temporary regressions. This said, I've just generated a token on the sandbox and tried to create an empty record with zen4R, it worked.

[hansvancalster]

Thanks for the quick reply. And sorry for the noise. I must have done something wrong before, because when I deleted the old token and created a new one, everything seems to work as expected.

[eblondel]

You're welcome, no noise, the important is that you got it work!