# Bad CSRF with mailgun replies **URL:** \ **Category:** Support\ **Created:** [October 13, 2017, 7:48pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029 "2017-10-13T19:48:09Z")\ **Posts on this page:** 1\ **Showing post:** 17
**Author:** ![DeanMarkTaylor](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deanmarktaylor/32/102462_2.png) [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)\ **Post date:** [October 15, 2017, 6:56pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/17 "2017-10-15T18:56:32Z")
> [@pfaffman](#): > > I’m using mailgun to forward discourse+%{reply\_key}@literatecomputing.com to a gmail inbox that is retrieved via pop3 and I believe that it’s working just fine. That’s not directly to Discourse via the HTTP POST API which is what this topic was about… GMail is acting as a middle man and this delays the processing of emails into Discourse by 1 to 2 times the POP3 polling time. There are a few other POP3/Gmail issues which use of the direct mechanism resolves. One thing you don’t get is Gmail’s superb SPAM processing. However there is already a decent level of protection both in the mail handler and Discourse especially if Akismet is installed. --- _[View the full topic](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029)._