Forbidden by CSRF on my registration form, not sure why

Question

I have setup CSRF on my Express v3 app, and I have it like this:

app.use(express.session({
  secret: "gdagadgagd",
  cookie: {
    httpOnly: true,
    path : '/',
    maxAge: 1000*60*60*24*30*12
  }
}));
app.use(express.csrf());
app.use(function(req, res, next) {
  res.locals.token = req.session._csrf;
  next();
})

and on my page the token appears as:

<input type="hidden" name="_csrf" value="E3afFADF3913-fadFK31">

But when I try to register on my webpage, I get this error:

Error: Forbidden
    at Object.exports.error (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/utils.js:55:13)
    at Object.handle (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/csrf.js:54:41)
    at next (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at next (/Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/session.js:313:9)
    at /Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/session.js:337:9
    at /Users/account/Desktop/nodeapp/node_modules/express/node_modules/connect/lib/middleware/session/memory.js:50:9
    at process._tickCallback (node.js:415:13)

I'm using Jade as my template engine and this is what I have:

input(type='hidden', name='_csrf', value=token)

I am accessing the webpage directly at localhost:3000 and I'm not sure why I am forbidden from registering an account. Thanks!

Answer 1

You should use bodyParser middleware, to let the server know that _csrf was passed.

Insert app.use(express.bodyParser()); before app.use(express.csrf());.