Keystone-classic: CSRF failure on any POST in admin with Keystone 0.3.6

[alsoicode]

Hi everyone,

I'm getting CSRF errors on any POST request in Keystone admin. What am I doing wrong?

[morenoh149]

are you crafting post requests or which post request are you seeing this error?

[alsoicode]

These are just the standard POST requests to create or edit an object in admin, nothing custom. Perhaps I didn't upgrade my site generated with Yeoman correctly? I just changed the version in my package.json to ^0.3 and re-ran npm install

[creynders]

@alsoicode did you refresh your browser _after_ restarting the keystone instance? If not, all CSRFs fail.

[albertogasparin]

Moreover double check your session timeout. In my dev settings the session duration is set to 3 minutes. So, if I end up editing something for more than that time, Keystone will return a CSRF error on save because the new session (generate in the meantime) invalidates the old token.

[alsoicode]

Looks like the session timeout was the issue.

[creynders]

Ah cool. Nice work @albertogasparin, glad it got solved @alsoicode

[alsoicode]

Yes, I'm liking the 0.3 admin better. How are you guys liking working with React?

[JedWatson]

@alsoicode glad to hear it! I'm loving it React, really happy with the choice.

Lots of improvements to come in the next few weeks too as @jossmac has a new css framework for us to replace Bootstrap with, and as we finish replacing all the old jade template stuff :D

[alsoicode]

I haven't tried it out myself, but I'm a big fan of Knockout.js. Are you moving to a custom framework? or?

[JedWatson]

@alsoicode we're creating a new framework for React called Elemental. It's a work in progress right now but there will be some demos up soon. Some of the core (grids, reset, etc) is "inspired by / based on" Bootstrap while the components are built on controls we've been working on for a while including my react-select package.

I'll write up a new issue to outline it!

[alsoicode]

Sweet. Checking out your touchstone project right now too.

[JedWatson]

@alsoicode yep, we have the trifecta:

• KeystoneJS for node back-ends
• TouchstoneJS for mobile apps
• Elemental UI for web apps

:grinning:

[alsoicode]

Sounds like a great plan. I'm a huge Django fan of course, but have been moving to Node slowly but surely. Thanks for all of the hard work on Keystone. It sure does make it easier for people to transition from Django, Rails, Laravel, etc to Node, versus starting with Express.