In NestJS I'm setting a POST request which doesn't...
# generalf
fragordie
03/30/2022, 4:52 PMIn NestJS I'm setting a POST request which doesn't work if using the Authentication guard. GET requests work, POST don't.
It seems to be
resp.headersSentr
rp_st
03/30/2022, 4:53 PM@User can maybe help out.
p
porcellus
03/30/2022, 5:02 PMHi, sorry, I'll be back in 30 mins.
resp.headersSentf
fragordie
03/30/2022, 5:03 PMdon't worry
fragordie
03/30/2022, 5:03 PMyeah, but look
fragordie
03/30/2022, 5:06 PM1. I'm sending a POST request - https://prnt.sc/PCEzc-Dnx731
2. In the auth guard, before calling the
verifySessionverifySession() Copy code
ts
if (resp.headersSent) {
throw new STError({
message: 'RESPONSE_SENT',
type: 'RESPONSE_SENT',
});
}fragordie
03/30/2022, 5:08 PMthe same with a get request... the variable is still set to false
fragordie
03/30/2022, 5:08 PMso it doesn't throw an error
p
porcellus
03/30/2022, 5:49 PMis the err variable set to anything?
f
fragordie
03/30/2022, 5:52 PMNo, err is undefined
p
porcellus
03/30/2022, 7:24 PMhmm, even when
headersSentporcellus
03/30/2022, 7:54 PMhmm, I can't really find any reason it should be like this. It's really strange that it's different for post and get, the only reason I can think of is if this guard is running for
/authrefreshTokenPathporcellus
03/30/2022, 7:54 PMif neither of those are true: do you have a repo where I can reproduce this issue? or could we try to debug this on a call?
porcellus
03/30/2022, 7:54 PMoh, and sorry for the late answer 🙂
r
rp_st
03/30/2022, 8:53 PMThe other diff between post and get is that get doesn’t require any anti csrf measures. So for example, get won’t require a custom header whilst post would.
f
fragordie
03/30/2022, 9:40 PMyes!
fragordie
03/30/2022, 9:41 PMthat seems to be the problem!
I passed antiCsrfCheck: false to the function and it works
fragordie
03/30/2022, 9:42 PMhow am I supposed to make it work with csfr check?
r
rp_st
03/30/2022, 9:42 PMI see. In the sign in request, do you get an explicit anti CSRF token back?
f
fragordie
03/30/2022, 9:42 PM{{baseURL}}/auth/signinup/code/consume
fragordie
03/30/2022, 9:42 PMthis one?
fragordie
03/30/2022, 9:43 PMI don't see anything related to csrf in any request
r
rp_st
03/30/2022, 9:44 PMno i mean in the reponse header from that API call
rp_st
03/30/2022, 9:44 PMDo you get any token indicating anti csrf token back?
f
fragordie
03/30/2022, 9:45 PMthe response:
fragordie
03/30/2022, 9:45 PMcookies
fragordie
03/30/2022, 9:45 PMheaders
fragordie
03/30/2022, 9:46 PMso, I guess no I don't
r
rp_st
03/30/2022, 9:46 PMAlright
rp_st
03/30/2022, 9:47 PMSo in the request header to the POST API call that's failing, you should pass the the header
rid: anti-csrff
fragordie
03/30/2022, 9:48 PMthat's weird, is it a workaround?
r
rp_st
03/30/2022, 9:49 PMnot a work around. It seems that based on your apiDomain and websiteDomain values, some anti csrf measure is needed. Passing a custom header is an anti-csrf measuer: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#use-of-custom-request-headers
rp_st
03/30/2022, 9:49 PMit is working if you pass that header?
f
fragordie
03/30/2022, 9:49 PMyes
r
rp_st
03/30/2022, 9:49 PMalso, when using our frontend SDK, this header is added automatically to your requests.. so you don't need to do anything special there. Jusr via postman, you have to set this.
f
fragordie
03/30/2022, 9:50 PMahhhhh
fragordie
03/30/2022, 9:50 PMokay, awesome, thank you so much for your time
8 Views