fix(immich): send x-csrf-token header on sync requests (fixes 'CSRF validation failed') #43

Merged

janpeter merged 1 commit from fix/immich-sync-csrf-token into main 2026-06-06 01:52:24 +02:00

Conversation 0 Commits 1 Files changed 3 +36 -1

janpeter commented 2026-06-06 01:51:22 +02:00

Owner

Copy link

Symptom: the Immich page renders, but clicking a sync button returns 403 'CSRF validation failed'.

Cause: proxy.ts (the Next.js middleware) enforces double-submit CSRF on mutating /api/* requests — the x-csrf-token header must equal the csrf_token cookie (set on GET, httpOnly:false). ImmichSyncButton did fetch(endpoint, { method: "POST" }) without the header. The library mutations work because they're server actions (path isn't /api/, so proxy.ts exempts them).

Fix: add readCsrfToken() (src/lib/csrf.ts) that reads the csrf_token cookie, and have ImmichSyncButton echo it in the x-csrf-token header. runImmichSyncRequest gains an optional csrfToken param so it stays unit-testable; added a test asserting the header is sent.

Verified: lint clean; build OK; button tests 3/3 (incl. the new CSRF-header case).

**Symptom:** the Immich page renders, but clicking a sync button returns **403 'CSRF validation failed'**. **Cause:** `proxy.ts` (the Next.js middleware) enforces **double-submit CSRF** on mutating `/api/*` requests — the `x-csrf-token` header must equal the `csrf_token` cookie (set on GET, `httpOnly:false`). `ImmichSyncButton` did `fetch(endpoint, { method: "POST" })` **without** the header. The library mutations work because they're **server actions** (path isn't `/api/`, so `proxy.ts` exempts them). **Fix:** add `readCsrfToken()` (`src/lib/csrf.ts`) that reads the `csrf_token` cookie, and have `ImmichSyncButton` echo it in the `x-csrf-token` header. `runImmichSyncRequest` gains an optional `csrfToken` param so it stays unit-testable; added a test asserting the header is sent. **Verified:** lint clean; build OK; button tests 3/3 (incl. the new CSRF-header case).

janpeter added 1 commit 2026-06-06 01:51:22 +02:00

fix(immich): send x-csrf-token header on sync requests ... 751640db7b

proxy.ts (the Next.js middleware) enforces double-submit CSRF on mutating
/api/* requests: the x-csrf-token header must equal the csrf_token cookie, or
it returns 403 'CSRF validation failed'. ImmichSyncButton POSTed to
/api/immich/sync/* without the header, so the sync buttons failed. (Other
mutations are server actions, whose path isn't /api/, so they're exempt.)

Add a readCsrfToken() helper that reads the (httpOnly:false) csrf_token cookie,
and have ImmichSyncButton echo it in the x-csrf-token header. runImmichSyncRequest
takes an optional csrfToken so it stays unit-testable; added a test asserting the
header is sent.

janpeter merged commit 6e0bac4135 into main 2026-06-06 01:52:24 +02:00

janpeter referenced this pull request from a commit 2026-06-06 01:52:26 +02:00

Merge pull request 'fix(immich): send x-csrf-token header on sync requests (fixes 'CSRF validation failed')' (#43) from fix/immich-sync-csrf-token into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

janpeter/Media-Organizer!43

No description provided.