如何解决"message":"无效的 csrf 令牌","code":"EBADCSRFTOKEN"？

我在 stackoverflow 中阅读了所有类似的问题，我在 csurf github 页面中检查了问题，但我无法弄清楚问题所在。这是 express 中间件文件：

const app = express();
const csrfProtection = csrf();
const MongoDBSessionStore = MongoDBStore(session);
const store = new MongoDBSessionStore({
  uri: process.env.MONGODB_URI!,collection: "sessions",});
app.set("view engine","ejs");
app.set("views",path.join(__dirname,"views"));
app.use(favicon(path.join(__dirname,"public","favicon.ico")));
app.use(cors());
app.use(express.json());
app.use(multer({ storage: fileStorage,fileFilter }).single("image")); //arrray for multiple
app.use(express.static(path.join(__dirname,"public")));
app.use("/images",express.static(path.join(__dirname,"images")));
app.use(helmet());
app.use(compression()); 
app.use(
  session({
    name: "ts-authentication-app",secret: process.env.SESSION_SECRET!,resave: false,saveUninitialized: false,store: store,})
);
app.use(csrfProtection);
app.use(flash());
app.use(isAuthroized);
app.use((req,res,next) => {
  res.locals.isAuthenticated = req?.session?.isLoggedIn;
  res.locals.csrftoken = req.csrftoken();
  console.log("token",req.csrftoken());
  next();
});

app.use("/admin",adminRoutes);
app.use(shopRoutes);
app.use(authRoutes);
app.get("/500",errorController.get500);
app.use(errorController.get404);
app.use(morgan("combined",{ stream: morganLogStream }));
app.use(errorHandler);

我正在使用 ejs 模板引擎。这是登录模板。

<formaction="/login" method="POST" >
            <div>
                <label for="email">E-Mail</label>
                <inputhttps://www.jb51.cc/tag/ara/" target="_blank">aram === ''email'') ? ''invalid'' : '''' %>"
                    type="email" 
                    name="email" 
                    id="email" 
                    value="<%= oldInput.email %>">
            </div>
            <div>
                <label for="password">Password</label>
                <inputhttps://www.jb51.cc/tag/ara/" target="_blank">aram === ''password'') ? ''invalid'' : '''' %>"
                    type="password" 
                    name="password" 
                    id="password" 
                    value="<%= oldInput.password %>">
            </div>
            <input type="hidden" name="_csrf" value="<%= csrftoken %>">
            <buttontype="submit">Login</button>
        </form>

• csrftoken 在模板中呈现。当我将“隐藏”类型更改为“文本”类型时，我在页面上看到了标记。

• 我注释掉了每个中间件，看看是否有任何中间件导致了问题，但我仍然收到错误消息。

• 我记录了请求对象，csrftoken: [Function: csrftoken], 附加到请求对象。

我仍然无法弄清楚问题。

解决方法

app.use(express.urlencoded({ extended: false }))

services.AddAntiforgery(options =>{ options.HeaderName = "X-CSRF-TOKEN-HEADER"; options.FormFieldName = "X-CSRF-TOKEN-FORM"; });

app.Use(next=>context=> 
            {
                var tokens = antiforgery.GetAndStoreTokens(context);
                context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,new CookieOptions() {HttpOnly=false });
                return next(context);
            });

@inject IJSRuntime JSRuntime

var token = await JSRuntime.InvokeAsync<string>("getCookie", "XSRF-TOKEN");

        //FORM
        HttpContent httpcontent = new StringContent($"X-CSRF-TOKEN-FORM={token}", System.Text.Encoding.UTF8);
        httpcontent.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue("application/x-www-form-urlencoded");

        using HttpResponseMessage responseMessage = await Http.PostAsync("WeatherForecast", httpcontent);
        forecasts = await JsonSerializer.DeserializeAsync<WeatherForecast[]>(await responseMessage.Content.ReadAsStreamAsync());

//HEADER
        Http.DefaultRequestHeaders.Add("X-CSRF-TOKEN-HEADER", token);
        forecasts = await Http.PostJsonAsync<WeatherForecast[]>("WeatherForecast", httpcontent);