# BAD CSRF on user modification

**URL:** https://meta.discourse.org/t/bad-csrf-on-user-modification/156914
**Category:** Support
**Created:** [July 6, 2020, 2:19pm UTC](https://meta.discourse.org/t/bad-csrf-on-user-modification/156914 "2020-07-06T14:19:19Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![tschuerle](https://avatars.discourse-cdn.com/v4/letter/t/bcef8e/32.png) [@tschuerle](https://meta.discourse.org/u/tschuerle)
#### Post date: [July 6, 2020, 2:19pm UTC](https://meta.discourse.org/t/bad-csrf-on-user-modification/156914/1 "2020-07-06T14:19:19Z")

</div>

Hi everyone,

we running in `["BAD CSRF"]` Errors (403, Forbidden) at the moment.  
Request with API-Key looks like:  
Url: `https://<domain>/u/tschuerle.json?api_key=<valid key>&api_username=tschuerle`  
Body: `{ "hide_profile_and_presence": true }`  
Method: `PUT`  
Headers: `"Content-Type"` to `"application/json"`

According to the web-hook logs It worked until April. At the moment we are running the lastest stable version `2.5.0`.

Usecase: Set profiles to private after user-creation via web-hook and let the user’s decide on their own, if they want to make their profile public.

Any hints?

Thanks,  
Thomas

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [July 6, 2020, 3:08pm UTC](https://meta.discourse.org/t/bad-csrf-on-user-modification/156914/2 "2020-07-06T15:08:16Z")

</div>

> [@tschuerle](#):
>
> Url: `https://<domain>/u/tschuerle.json?api_key=<valid key>&api_username=tschuerle`

API Keys now need to be set as headers instead of URL parameters. Check [docs.discourse.org](http://docs.discourse.org) for details.

---

<div class="post-metadata">

### Author: ![tschuerle](https://avatars.discourse-cdn.com/v4/letter/t/bcef8e/32.png) [@tschuerle](https://meta.discourse.org/u/tschuerle)
#### Post date: [July 6, 2020, 3:20pm UTC](https://meta.discourse.org/t/bad-csrf-on-user-modification/156914/3 "2020-07-06T15:20:53Z")

</div>

Oh, I missed that. It’s working with that  
Thank you @Falco

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [August 5, 2020, 3:20pm UTC](https://meta.discourse.org/t/bad-csrf-on-user-modification/156914/4 "2020-08-05T15:20:54Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.