Do I use correctly next-csrf ??

[nataliagoskapracuj]

sorry for posting a question here, but I don't know if it's me who makes a mistake or is it problem with a package.
My application doesn't have a login or anything like this, so I created an empty endpoint that only sets a cookie when entering the page, and then I submit a form

My setup:

// service/csrf.js
import { nextCsrf } from "next-csrf";

const CSRF_SECRET = process.env.CSRF_SECRET;
const options = {
  secret: CSRF_SECRET
};

export const { csrf, csrfToken } = nextCsrf(options);

//pages/api/csrf.js
import { csrf } from "service/csrf";

async function handler(req, res) {
  return res.status(200).end();
}

export default csrf(handler);

//pages/_app.js
import { csrfToken } from "service/csrf";

function MyApp({ Component, pageProps }) {
  return (
      <Component {...pageProps} csrfToken={csrfToken} />
  );
}
export default MyApp;

// pages/index.js
export default function HomePage({
  csrfToken,
}) {
  useEffect(() => {
  // first request to set a cookie
    apiRequest({
      method: httpMethods.GET,
      url: "api/csrf",
      headers: {
        "XSRF-TOKEN": csrfToken,
      },
    });
  }, []);

  return (
          <Form
            csrfToken={csrfToken}
          />
  );
}

const Form = ({ csrfToken }) => {
  const handleSubmit = (event) => {
    event.preventDefault();
    apiRequest({
      method:  "POST",
      url: `api/send-form`,
      data: {
          //....
      },
      headers: {
        "XSRF-TOKEN": csrfToken,
      },
    })
      .then(() => {
      })
      .catch((error) => {
      });
  };

  return (
        <form onSubmit={handleSubmit}>
             //....
        </form>
  );
};

// pages/api/send-form.js

import { csrf } from "service/csrf";

async function handler(req, res) {
 // ....
}

export default csrf(handler);

It returns 403 at this moment https://github.com/j0lv3r4/next-csrf/blob/main/src/middleware/csrf.ts#L64

I changed a package in node module to reflect the last changes that where made in this PR #31 because there is no new version of package with those changes.

[juanbzpy]

Hey, @nataliagoskapracuj. I need to make a new release, but I haven't had the time.

I will try to get it done this weekend.

[nizarfadlan]

Hey, @nataliagoskapracuj. I need to make a new release, but I haven't had the time.

I will try to get it done this weekend.

I'm waiting for it sir, hopefully it will be released soon

[akeuk]

@j0lv3r4 Can we workaround by using older released?

[juanbzpy]

This got fixed with https://github.com/j0lv3r4/next-csrf/releases/tag/v0.2.1

[juanbzpy]

I'm going to close this. Please re-open if you are still having this issue.