<![CDATA[CSRF-Invalid error Cannot Login after upgrade to package 2.31.5]]>Hello, I am seeing "error=csrf-invalid" with a NodeBB installation recently upgraded to 4.14.5.
The installation is NodeBB 4.14.5 (package version 2.31.5) running in Cloudron 9.2.0 on Ubuntu 24.04.4.
Existing sessions continue to work; observed issues are:

  • All attempts to login result in "error=csrf-invalid" and the message "Login Unsuccessful // We were unable to log you in, likely due to an expired session. Please try again"
  • NodeBB users with "admin" privilege cannot actually get to the admin panel (clicking on the "admin" icon takes the user to the /user/admin page rather than the /admin page)

Simple things like "(on the server side) let's restart the app and see what happens" and "(on the client side) let's clear all browser cache/cookies/history/data" and "let's try this on different browsers (Safari/Brave/Chrome)" have been tried to no avail.

Any advice for what else I should try?

]]>https://forum.cloudron.io/topic/15777/csrf-invalid-error-cannot-login-after-upgrade-to-package-2.31.5RSS for NodeMon, 24 Aug 2026 03:36:29 GMTSun, 02 Aug 2026 21:31:02 GMT60<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Wed, 05 Aug 2026 17:49:00 GMT]]>@Joseph , yes, waiting for Cloudron 10 makes sense in this case, thank you!

]]>https://forum.cloudron.io/post/127768https://forum.cloudron.io/post/127768Wed, 05 Aug 2026 17:49:00 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Wed, 05 Aug 2026 09:14:15 GMT]]>@axtremus the maxMemoryPolicy can be set now in the package but it requires Cloudron 10 . So, I think the answer is to wait a bit for Cloudron 10.

]]>https://forum.cloudron.io/post/127749https://forum.cloudron.io/post/127749Wed, 05 Aug 2026 09:14:15 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Tue, 04 Aug 2026 19:16:23 GMT]]>@Joseph , you make a good point and I have follow up on this topic at https://community.nodebb.org/topic/19410/csrf-invalid-login-issue-with-nodebb-4.14.5/

That said, one suggestion received from there is to "check your redis config and make sure it has an eviction policy set to something like volatile-lru" ... for this, it seems I need to come back and ask a question here because I don't seem able to find my redis.conf file in the usual places like /etc/redis.conf or /etc/redis/redis.conf, so I come back here to ask if maybe the folks who "package" up NodeBB for Cloudron can clue me into where I can find redis.conf in the NodeBB package for Cloudron. Thanks in advance!

]]>https://forum.cloudron.io/post/127716https://forum.cloudron.io/post/127716Tue, 04 Aug 2026 19:16:23 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Mon, 03 Aug 2026 16:51:06 GMT]]>@axtremus this question might be better suited for the NodeBB forum itself (https://community.nodebb.org/) since it's an implementation detail of the app.

]]>https://forum.cloudron.io/post/127662https://forum.cloudron.io/post/127662Mon, 03 Aug 2026 16:51:06 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Mon, 03 Aug 2026 12:35:10 GMT]]>Update: Flushing Redis worked ... now the system allows logins again. The cost is everyone needs to re-login (not ideal, but tolerable).

Now I would like to investigate what caused Redis' memory to fill up in the first place.

One working theory is that we're being targeted by bots, but the number of logins I can see are rather modest and there has been no "spike" in those stats. We do have "guess visitors" and "guess page views" (also no "spike" on those stats) ... so if any one here knows the answer, my question now is this:

  • Does NodeBB generate new Redis entries for "guess visits" or "guess page views"?
  • Anything else you can think of that would cause NodeBB to add entries to Redis?
]]>https://forum.cloudron.io/post/127649https://forum.cloudron.io/post/127649Mon, 03 Aug 2026 12:35:10 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Mon, 03 Aug 2026 11:34:30 GMT]]>@Joseph , my list of "enabled" plagins below:

# ./nodebb plugins | grep enabled
        * @nodebb/nodebb-plugin-reactions@3.0.1 (installed, enabled)
        * nodebb-plugin-btn-spoilers@0.4.1 (installed, enabled)
        * nodebb-plugin-composer-default@11.0.8 (installed, enabled)
        * nodebb-plugin-dbsearch@7.0.0 (installed, enabled)
        * nodebb-plugin-embed@3.0.19 (installed, enabled)
        * nodebb-plugin-emoji@6.0.14 (installed, enabled)
        * nodebb-plugin-emoji-android@4.1.1 (installed, enabled)
        * nodebb-plugin-markdown@13.2.6 (installed, enabled)
        * nodebb-plugin-mentions@5.0.0 (installed, enabled)
        * nodebb-plugin-twitter-netdata@1.0.0 (installed, enabled)
        * nodebb-rewards-essentials@1.0.3 (installed, enabled)
        * nodebb-theme-harmony@3.1.9 (installed, enabled)
        * nodebb-widget-essentials@8.0.4 (installed, enabled)

@James , yes, I see the line "trust-proxy" : true in my config.json file.

Another suspect is some sort of Redis "memory full" condition preventing new logins from happening. When I check Redis memory usage, I see these two lines:

used_memory:257978864
maxmemory:257949696

used_memory seems to have exceeded maxmemory a bit; but at this point I do not know what's filling up Redis memory.

]]>https://forum.cloudron.io/post/127648https://forum.cloudron.io/post/127648Mon, 03 Aug 2026 11:34:30 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Mon, 03 Aug 2026 07:44:44 GMT]]>Hello @axtremus
We addressed a CSRF-Invalid error this in the NodeBB update 4.14.4/diff.
And it was also addressed upstream https://community.nodebb.org/topic/19405/trust_proxy-will-default-to-false-in-4.14.3
The Cloudron package always sets "trust_proxy": true.

Can you please check your /run/nodebb/config.json file with the Web Terminal if trust_proxy: true exists in there?

]]>https://forum.cloudron.io/post/127639https://forum.cloudron.io/post/127639Mon, 03 Aug 2026 07:44:44 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Mon, 03 Aug 2026 07:39:23 GMT]]>As @robi said most likely something plugin related. What plugins do you have installed?

]]>https://forum.cloudron.io/post/127638https://forum.cloudron.io/post/127638Mon, 03 Aug 2026 07:39:23 GMT<![CDATA[Reply to CSRF-Invalid error Cannot Login after upgrade to package 2.31.5 on Sun, 02 Aug 2026 22:14:18 GMT]]>@Axtremus save logs, check custom plugins, then restore from backup until issue resolved.

]]>https://forum.cloudron.io/post/127630https://forum.cloudron.io/post/127630Sun, 02 Aug 2026 22:14:18 GMT