Skip to content
deedglassdocs

csrf_failed

A Console request that changes something (POST, PUT, PATCH or DELETE) came without the Deedglass-CSRF header, with a header that doesn’t match the Host-deedglasscsrf cookie or the session, or from…

HTTP 403 · permission_error · not retryable

What happened

Section titled “What happened”

A Console request that changes something (POST, PUT, PATCH or DELETE) came without the Deedglass-CSRF header, with a header that doesn’t match the __Host-deedglass_csrf cookie or the session, or from another site (Sec-Fetch-Site: cross-site, or an Origin that isn’t this server). It stops other websites from acting with your session.

What to do

Section titled “What to do”

Reload the page. Scripts send the csrf_token from GET /v1/me as Deedglass-CSRF. API keys (Authorization: Bearer) never need it.

Example

Section titled “Example”
HTTP 403 · csrf_failed
{
  "error": {
    "type": "permission_error",
    "code": "csrf_failed",
    "message": "This request is missing its security token. Reload the page and try again.",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/csrf_failed"
  }
}

The message is for a person and can get more exact over time: branch on type and code, never on the message.

In the SDKs

Section titled “In the SDKs”
SDK Raised as
TypeScript (@deedglass/sdk) PermissionDeniedError with code === "csrf_failed"
Python (deedglass) deedglass.PermissionDeniedError with .code == "csrf_failed"
Section titled “Related”