# Bad CSRF with mailgun replies

**URL:** https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029
**Category:** Support
**Created:** [October 13, 2017, 7:48pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029 "2017-10-13T19:48:09Z")
**Posts on this page:** 20
**Page:** 1

<div class="post-metadata">

### Author: ![Jeff\_Vienneau](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeff_vienneau/32/108772_2.png) [@Jeff\_Vienneau](https://meta.discourse.org/u/Jeff_Vienneau)
#### Post date: [October 13, 2017, 7:48pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/1 "2017-10-13T19:48:09Z")

</div>

Hi,

I am trying to setup inbound email handling with mailgun and the http post API.

Things I have configured:  
Mailgun API key.  
manual polling enabled = checked  
reply email address replay@mydomain  
reply by email enabled = checked

Added a mailgun route:  
match\_recipient(“.\*@mydomain”)  
forward"([http://mydomain/admin/email/handle\_mail&type=mime](http://mydomain/admin/email/handle_mail&type=mime)")

MX record and am receiving replys in mailgun logs.

Is there anything else I need to configure to fix “BAD CSRF”?  
Do I need a plugin or API web hook or something?

---

<div class="post-metadata">

### Author: ![Jeff\_Vienneau](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeff_vienneau/32/108772_2.png) [@Jeff\_Vienneau](https://meta.discourse.org/u/Jeff_Vienneau)
#### Post date: [October 13, 2017, 9:14pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/2 "2017-10-13T21:14:44Z")

</div>

Does inbound mail use “handle\_mail” endpoint when configured for mailgun?

---

<div class="post-metadata">

### Author: ![Jeff\_Vienneau](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeff_vienneau/32/108772_2.png) [@Jeff\_Vienneau](https://meta.discourse.org/u/Jeff_Vienneau)
#### Post date: [October 13, 2017, 9:41pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/3 "2017-10-13T21:41:36Z")

</div>

I think I solved the Bad CSRF issue by adding user and api key to the URL but now I am seeing and error in the logs: admin/email\_controller.rb error at line 86, missing required parameter "email’.

Can I assume this is a json parameter that mailgun is not populating because of wrong API or something?

---

<div class="post-metadata">

### Author: ![Jeff\_Vienneau](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeff_vienneau/32/108772_2.png) [@Jeff\_Vienneau](https://meta.discourse.org/u/Jeff_Vienneau)
#### Post date: [October 14, 2017, 12:21am UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/4 "2017-10-14T00:21:50Z")

</div>

The logs:

```
/var/www/discourse/vendor/bundle/ruby/2.3.0/gems/actionpack-4.2.8/lib/action_controller/metal/strong_parameters.rb:251:in `require'
/var/www/discourse/app/controllers/admin/email_controller.rb:86:in `handle_mail'
/var/www/discourse/vendor/bundle/ruby/2.3.0/gems/actionpack-4.2.8/lib/action_controller/metal/implicit_render.rb:4:in `send_action'

```

---

<div class="post-metadata">

### Author: ![DeanMarkTaylor](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deanmarktaylor/32/102462_2.png) [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [October 15, 2017, 1:11am UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/5 "2017-10-15T01:11:00Z")

</div>

### TL;DR:

I don’t believe Mailgun’s mail forwarding will work as-is with Discourse. It doesn’t pass the email data in the right way and there doesn’t appear to be a way to change that on either end Mailgun nor Discourse.

* * *

### The detail

Within Mailgun’s documentation there is a [Django code example](https://documentation.mailgun.com/en/latest/quickstart-receiving.html#supported-actions-for-routes) which indicates what is passed to the HTTP endpoint by mailguns `forward` functionality.

An example payload at the bottom of [this page](http://mailgun-documentation.readthedocs.io/en/latest/api-routes.html#examples) confirms this.

For reference here is the code sample:

> Consider this Django code:
> 
> ```Django
> # Handler for HTTP POST to http://myhost.com/messages for the route defined above
> def on_incoming_message(request):
> if request.method == 'POST':
> sender = request.POST.get('sender')
> recipient = request.POST.get('recipient')
> subject = request.POST.get('subject', '')
> 
> body_plain = request.POST.get('body-plain', '')
> body_without_quotes = request.POST.get('stripped-text', '')
> # note: other MIME headers are also posted here...
> 
> # attachments:
> for key in request.FILES:
> file = request.FILES[key]
> # do something with the file
> 
> # Returned text is ignored but HTTP status code matters:
> # Mailgun wants to see 2xx, otherwise it will make another attempt in 5 minutes
> return HttpResponse('OK')
> 
> ```

Note that this means that many POST parameters including `sender`, `recipient`, `subject`, `body-plain`, `stripped-text` and files as separate “chunks”.

This is not what Discourse expects to be sent to the `/admin/email/handle_mail` endpoint - it simply wants the complete raw email as the `email` parameter.

---

<div class="post-metadata">

### Author: ![Jeff\_Vienneau](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeff_vienneau/32/108772_2.png) [@Jeff\_Vienneau](https://meta.discourse.org/u/Jeff_Vienneau)
#### Post date: [October 15, 2017, 12:35pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/6 "2017-10-15T12:35:25Z")

</div>

Thanks a bunch, @DeanMarkTaylor.

I’ll pursue different method then.

---

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [October 15, 2017, 2:41pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/7 "2017-10-15T14:41:58Z")

</div>

Take a look at

> [@Configure direct-delivery incoming email for self-hosted sites with Mail-Receiver](https://meta.discourse.org/t/straightforward-direct-delivery-incoming-mail/49487):
>
> Discourse is all about enabling civilized discussion. While plenty of people like a web interface, e-mail is still the “hub” of many people’s online lives. That’s why sending e-mail is so important, and when you’re sending e-mail, you really want to be able to receive it, too. There are several reasons why: If e-mails “bounce” (they can’t be delivered for some reason), you need to know about that. Repeatedly sending e-mails that bounce will get your e-mails flagged as spam. Receiving e-ma…

---

<div class="post-metadata">

### Author: ![dfriestedt](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dfriestedt](https://meta.discourse.org/u/dfriestedt)
#### Post date: [October 15, 2017, 5:20pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/8 "2017-10-15T17:20:55Z")

</div>

I followed these directions exactly, and am getting the following error at mailgun. Should I assume that I need to migrate away from mailgun to receive reply emails?

Also, I’m confused what the mailgun api key is used for. Says it’s used to verify webhook messages. Can someone elaborate?

```
{
"severity": "temporary",
"tags": [],
"storage": {
    "url": "https://se.api.mailgun.net/v3/domains/reply.volyoom.fit/messages/eyJwIjpmYWxzZSwiayI6IjhiYTFjMTI0LWVhNmQtNDcxZC05MzU5LTNiNzhjZGY2MGJmYSIsInMiOiJkNDFhMjFlMDRmIiwiYyI6InRhbmtiIn0=",
    "key": "REMOVED"
},
"delivery-status": {
    "attempt-no": 1,
    "description": "[\"BAD CSRF\"]",
    "session-seconds": 0.07819604873657227,
    "retry-seconds": 600,
    "code": 403,
    "message": "[\"BAD CSRF\"]"
},
"recipient-domain": "REMOVED",
"id": "QRcFjJ3NSKu0Hn9pfPnGyQ",
"campaigns": [],
"reason": "generic",
"user-variables": {},
"flags": {
    "is-routed": false,
    "is-authenticated": false,
    "is-system-test": false,
    "is-test-mode": false
},
"log-level": "warn",
"timestamp": 1508087126.237296,
"envelope": {
    "sender": "REMOVED",
    "transport": "http",
    "targets": "REMOVED/admin/email/handle_mail"
},
"message": {
    "headers": {
        "to": "REMOVED Forum <replies+ddcd9246b485715a803756190c86e6e5@REMOVED>",
        "message-id": "ADBE049D-0179-4B3C-813A-517A02741FBD@monroeresidential.com",
        "from": "Drew Friestedt <REMOVED>",
        "subject": "Re: [REMOVED Forum] [Zwift] This is a test topic with email reply"
    },
    "attachments": [],
    "size": 7044
},
"recipient": "REMOVED/admin/email/handle_mail",
"event": "failed"

```

---

<div class="post-metadata">

### Author: ![DeanMarkTaylor](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deanmarktaylor/32/102462_2.png) [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [October 15, 2017, 5:29pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/9 "2017-10-15T17:29:34Z")

</div>

> [@dfriestedt](#):
>
> Should I assume that I need to migrate away from mailgun to receive reply emails?

Yes, see my earlier post:

> [@DeanMarkTaylor](#):
>
> I don’t believe Mailgun’s mail forwarding will work as-is with Discourse. It doesn’t pass the email data in the right way and there doesn’t appear to be a way to change that on either end Mailgun nor Discourse.

---

<div class="post-metadata">

### Author: ![dfriestedt](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dfriestedt](https://meta.discourse.org/u/dfriestedt)
#### Post date: [October 15, 2017, 5:34pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/10 "2017-10-15T17:34:27Z")

</div>

Got it. I did see that but was hoping it was wrong. Can you recommend a solution that does work to deliver reply messages with mail-receiver?

---

<div class="post-metadata">

### Author: ![DeanMarkTaylor](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deanmarktaylor/32/102462_2.png) [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [October 15, 2017, 5:37pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/11 "2017-10-15T17:37:19Z")

</div>

> [@dfriestedt](#):
>
> Can you recommend a solution that does work to deliver reply messages with mail-receiver?

The recommended solution has already been posted too:

> [@Bad CSRF with mailgun replies](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/7):
>
> Take a look at

> [@Configure direct-delivery incoming email for self-hosted sites with Mail-Receiver](https://meta.discourse.org/t/straightforward-direct-delivery-incoming-mail/49487):
>
> Discourse is all about enabling civilized discussion. While plenty of people like a web interface, e-mail is still the “hub” of many people’s online lives. That’s why sending e-mail is so important, and when you’re sending e-mail, you really want to be able to receive it, too. There are several reasons why: If e-mails “bounce” (they can’t be delivered for some reason), you need to know about that. Repeatedly sending e-mails that bounce will get your e-mails flagged as spam. Receiving e-ma…

---

<div class="post-metadata">

### Author: ![dfriestedt](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dfriestedt](https://meta.discourse.org/u/dfriestedt)
#### Post date: [October 15, 2017, 5:42pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/12 "2017-10-15T17:42:22Z")

</div>

I did follow those directions exactly. I’m getting the following message in the log file, so it’s working perfectly.

\<22\>Oct 15 16:29:08 postfix/master[1]: daemon started – version 3.1.1, configuration /etc/postfix

However, mailgun is still unable to deliver the messages. The log file posted above is from mailgun after setting up mail-receiver.

---

<div class="post-metadata">

### Author: ![dfriestedt](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dfriestedt](https://meta.discourse.org/u/dfriestedt)
#### Post date: [October 15, 2017, 5:48pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/13 "2017-10-15T17:48:53Z")

</div>

I’m reviewing my other setting to make sure I have not missed anything:  
manual polling enabled = True  
mailgun api key = Provided  
reply by email enabled = True  
reply by email address = replies+%{reply\_key}@example.com  
at mailgun - Forward to: [http://example.com/admin/email/handle\_mail](http://example.com/admin/email/handle_mail)

---

<div class="post-metadata">

### Author: ![DeanMarkTaylor](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deanmarktaylor/32/102462_2.png) [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [October 15, 2017, 6:03pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/14 "2017-10-15T18:03:21Z")

</div>

> [@dfriestedt](#):
>
> I did follow those directions exactly.

> [@dfriestedt](#):
>
> However, mailgun is still unable to deliver the messages.

> [@dfriestedt](#):
>
> at mailgun - Forward to: [http://example.com/admin/email/handle\_mail](http://example.com/admin/email/handle_mail)

Please [re-read the instructions](https://meta.discourse.org/t/straightforward-direct-delivery-incoming-mail/49487) linked as they have nothing to do with mailgun - mailgun will not be used for receiving mail when following those instructions correctly.

---

<div class="post-metadata">

### Author: ![dfriestedt](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dfriestedt](https://meta.discourse.org/u/dfriestedt)
#### Post date: [October 15, 2017, 6:07pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/15 "2017-10-15T18:07:07Z")

</div>

Sorry - I see. Pure stupidity on my part. Thx for pointing me in the right direction. Inbound email gets delivered and processed by your own server and as you mentioned, does not hit mailgun. Need to open port 25 on EC2 instance.

Thank you!

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [October 15, 2017, 6:41pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/16 "2017-10-15T18:41:09Z")

</div>

> [@DeanMarkTaylor](#):
>
> I don’t believe Mailgun’s mail forwarding will work as-is with Discourse. It doesn’t pass the email data in the right way and there doesn’t appear to be a way to change that on either end Mailgun nor Discourse.

I’m using mailgun to forward discourse+%{reply\_key}@literatecomputing.com to a gmail inbox that is retrieved via pop3 and I believe that it’s working just fine.

---

<div class="post-metadata">

### Author: ![DeanMarkTaylor](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deanmarktaylor/32/102462_2.png) [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [October 15, 2017, 6:56pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/17 "2017-10-15T18:56:32Z")

</div>

> [@pfaffman](#):
>
> I’m using mailgun to forward discourse+%{reply\_key}@literatecomputing.com to a gmail inbox that is retrieved via pop3 and I believe that it’s working just fine.

That’s not directly to Discourse via the HTTP POST API which is what this topic was about…

GMail is acting as a middle man and this delays the processing of emails into Discourse by 1 to 2 times the POP3 polling time.

There are a few other POP3/Gmail issues which use of the direct mechanism resolves.

One thing you don’t get is Gmail’s superb SPAM processing. However there is already a decent level of protection both in the mail handler and Discourse especially if Akismet is installed.

---

<div class="post-metadata">

### Author: ![Jeff\_Vienneau](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeff_vienneau/32/108772_2.png) [@Jeff\_Vienneau](https://meta.discourse.org/u/Jeff_Vienneau)
#### Post date: [October 15, 2017, 7:27pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/18 "2017-10-15T19:27:45Z")

</div>

Thanks, got it working with the mail receiver method.

---

<div class="post-metadata">

### Author: ![kerray](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kerray/32/139168_2.png) [@kerray](https://meta.discourse.org/u/kerray)
#### Post date: [April 25, 2019, 8:01am UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/19 "2019-04-25T08:01:55Z")

</div>

I wanted to make reply via email work from Mailgun, and found out that this plugin fork works: [GitHub - halkeye/discourse-mailgun: A plugin for Discourse to accept inbound email from a Mailgun webhook · GitHub](https://github.com/halkeye/discourse-mailgun)

So Reply by email is possible just with Mailgun, you just need to install this plugin.

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [August 3, 2022, 11:47am UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/21 "2022-08-03T11:47:50Z")

</div>