Improve invalid CSRF token logging + add explicit dependency

[melroy89]

Small improvements:

• Add $id to invalid CSRF error message. So we know which ID is causing the issue.
• Add missing symfony/security-csrf explict dependency

[melroy89]

ow.. I got finally something in my log (after a long time of waiting):

{"message":"Uncaught PHP Exception Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException: \"Invalid CSRF token, with ID: favourite. Is token a string?: 1\" at AbstractController.php line 40","context":{"exception":{"class":"Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException","message":"Invalid CSRF token, with ID: favourite. Is token a string?: 1","code":0,"file":"/var/www/kbin.melroy.org/html/src/Controller/AbstractController.php:40"}},"level":400,"level_name":"ERROR","channel":"request","datetime":"2024-09-14T15:10:01.670332+02:00","extra":{}}
{"message":"Uncaught PHP Exception Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException: \"Invalid CSRF token, with ID: favourite. Is token a string?: 1\" at AbstractController.php line 40","context":{"exception":{"class":"Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException","message":"Invalid CSRF token, with ID: favourite. Is token a string?: 1","code":0,"file":"/var/www/kbin.melroy.org/html/src/Controller/AbstractController.php:40"}},"level":400,"level_name":"ERROR","channel":"request","datetime":"2024-09-14T15:10:02.069033+02:00","extra":{}}

[BentiGorlich]

Could it be a problem the antispam bundle as well? Am 14. September 2024 15:30:32 MESZ schrieb Melroy van den Berg ***@***.***>:

…

ow.. I got finally something in my log (after a long time of waiting): ```json {"message":"Uncaught PHP Exception Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException: \"Invalid CSRF token, with ID: favourite. Is token a string?: 1\" at AbstractController.php line 40","context":{"exception":{"class":"Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException","message":"Invalid CSRF token, with ID: favourite. Is token a string?: 1","code":0,"file":"/var/www/kbin.melroy.org/html/src/Controller/AbstractController.php:40"}},"level":400,"level_name":"ERROR","channel":"request","datetime":"2024-09-14T15:10:01.670332+02:00","extra":{}} {"message":"Uncaught PHP Exception Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException: \"Invalid CSRF token, with ID: favourite. Is token a string?: 1\" at AbstractController.php line 40","context":{"exception":{"class":"Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException","message":"Invalid CSRF token, with ID: favourite. Is token a string?: 1","code":0,"file":"/var/www/kbin.melroy.org/html/src/Controller/AbstractController.php:40"}},"level":400,"level_name":"ERROR","channel":"request","datetime":"2024-09-14T15:10:02.069033+02:00","extra":{}} ``` -- Reply to this email directly or view it on GitHub: #1130 (comment) You are receiving this because you are subscribed to this thread. Message ID: ***@***.***>

[melroy89]

Could it be a problem the antispam bundle as well?

Nah, our anti-spam bundle is only implemented on two forms: Registration form & contact form... Also I would expect to see another error message in that case. What you see above is an invalid CSRF.. Most likely due to caching.. or <unknown>.

[osaerisxero]

This happens to me fairly regularly, but i believe only on mobile, which I use via webclip on Android with Firefox as the browser. Are you wanting the uri of the error page when it occurs?

[melroy89]

This happens to me fairly regularly, but i believe only on mobile, which I use via webclip on Android with Firefox as the browser. Are you wanting the uri of the error page when it occurs?

Thanks for responding!

@osaerisxero Sorry, webclip? webclip is apple I think. But maybe you mean Progressive Web App (PWA) installed on the home screen of your Android device using Firefox?

Any info would help, like:

• What is the instance you are using? kbin.melroy.org or something else?
• What android version?
• Firefox or a special fork of Firefox?
• Do you mean you installed it as a PWA application on your android home screen?
• What is the full URL when this happens?
• Do you get an error page or are you logged-out?
• What action did you perform before this happened? Like voting, boost or anything else?..
• Anything else I couldn't think of right now.. If you can share more info the better (the only thing I don't need to know is your pincode 😆 )

[osaerisxero]

Ha, yes, I mean PWA.

Firefox version 130.0 (Build #2016041319), hg-b73ccdf1f861+

KES extension version 4.2.1

@[email protected]

The URL does match the choice=1 format when it happens iirc, but I will need to look up how to make the pwa session expose the url bar and/or dev tools so i can provide a full one or a peek at the browser console. I should have some free time this evening to tinker with it.

[osaerisxero]

Amusingly it happened 2 upvotes after I sent the prior message. I'm going to switch to being in the full browser for the rest of the afternoon to see if I can get the error to pop there.

[melroy89]

Amusingly it happened 2 upvotes after I sent the prior message. I'm going to switch to being in the full browser for the rest of the afternoon to see if I can get the error to pop there.

I was following the logs live at the moment. So I got the exact errors you experienced I believe. These seems to be coming from "favourite" which is indeed when you upvote a comment in a thread for example:

{"message":"Uncaught PHP Exception Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException: \"Invalid CSRF token, with ID: favourite. Is token a string?: 1\" at AbstractController.php line 40","context":{"exception":{"class":"Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException","message":"Invalid CSRF token, with ID: favourite. Is token a string?: 1","code":0,"file":"/var/www/kbin.melroy.org/html/src/Controller/AbstractController.php:40"}},"level":400,"level_name":"ERROR","channel":"request","datetime":"2024-09-14T20:09:02.740028+02:00","extra":{}}
{"message":"Uncaught PHP Exception Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException: \"Invalid CSRF token, with ID: favourite. Is token a string?: 1\" at AbstractController.php line 40","context":{"exception":{"class":"Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException","message":"Invalid CSRF token, with ID: favourite. Is token a string?: 1","code":0,"file":"/var/www/kbin.melroy.org/html/src/Controller/AbstractController.php:40"}},"level":400,"level_name":"ERROR","channel":"request","datetime":"2024-09-14T20:09:03.128857+02:00","extra":{}}

We just don't know yet why the CSRF tokens become invalid.. The only thing we expect what is happening, is due to some Symfony cache.

[osaerisxero]

It does proc on standard-browser-mode firefox. I should have hooked it up to a desktop browser for debugging before that, but I've got it hooked up now. We'll see what we can see if I can get it to proc again before I have to stop working on this for a while :)

[melroy89]

Latest info of Jerry, the CSRF IDs that he is seeing in the error logs are:

• vote (down vote)
• favourite (up vote)
• boost
• subscribe