what is CSRF check failed when going on a website which doesn't require login?

javascript python html request web-crawler

11,864

CSRF prevents users from using the same tokens to make a request from outside of their own session on a website. You are probably submitting some form of token that was generated in your browser session, and then making the request from another device. More on CSRF here.

CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim's behalf. For most sites, browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, Windows domain credentials, and so forth. Therefore, if the user is currently authenticated to the site, the site will have no way to distinguish between the forged request sent by the victim and a legitimate request sent by the victim.

Essentially, it thinks your request is a malicious person that got you to make a call from their computer.

Given the error message: CSRF check failed. Please enable cookies., I feel this token is stored in a cookie. Here's how I would go about getting around this:

Open the chrome developer console
Open the network tab
Reload the page
Right click the main page's request
Mouse of "Copy", and then in the side drop out select "Copy as cURL"
Go to https://curl.trillworks.com and past your cURL command in to get a python requests program that will make the same request.

11,864

Author by

Mohit Joshi

Updated on June 04, 2022

Comments

Mohit Joshi almost 2 years

I am new to web-crawling and HTML stuff. I am trying to get the content of this site: https://services.ecourts.gov.in/ecourtindiaHC/cases/s_orderdate.php?state_cd=24&dist_cd=1&court_code=1&stateNm=Sikkim But getting some error.

session = requests.Session()
path = 
'https://services.ecourts.gov.in/ecourtindiaHC/cases/s_orderdate.php? 
 state_cd=24&dist_cd=1&court_code=1&stateNm=Sikkim'
 r2n = session.post(path)
 r2n.content

Error:

<html>
  <head>
    <title>CSRF check failed</title>
    <script type="text/javascript">var csrfMagicToken = "sid:c5118ae8a9e61592d303891cc2cd269c204972a8,1563237610";var csrfMagicName = "__csrf_magic";</script><script src="csrf-magic.js" type="text/javascript"></script>
  </head>
  <body>
    CSRF check failed. Please enable cookies.<br />Debug: <script type="text/javascript">CsrfMagic.end();</script>
  </body>
</html>