# Bad CSRF with mailgun replies

**URL:** <https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029>\
**Category:** Support\
**Created:** [October 13, 2017, 7:48pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029 "2017-10-13T19:48:09Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Jeff\_Vienneau](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeff_vienneau/32/108772_2.png) [@Jeff\_Vienneau](https://meta.discourse.org/u/Jeff_Vienneau)\
**Post date:** [October 13, 2017, 7:48pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/1 "2017-10-13T19:48:09Z")

</div>

Hi,

I am trying to setup inbound email handling with mailgun and the http post API.

Things I have configured:  
Mailgun API key.  
manual polling enabled = checked  
reply email address replay@mydomain  
reply by email enabled = checked

Added a mailgun route:  
match\_recipient(“.\*@mydomain”)  
forward"([http://mydomain/admin/email/handle\_mail&type=mime](http://mydomain/admin/email/handle_mail&type=mime)")

MX record and am receiving replys in mailgun logs.

Is there anything else I need to configure to fix “BAD CSRF”?  
Do I need a plugin or API web hook or something?

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029)._