# Bad CSRF with mailgun replies

**URL:** <https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029>\
**Category:** Support\
**Created:** [October 13, 2017, 7:48pm UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029 "2017-10-13T19:48:09Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![DeanMarkTaylor](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deanmarktaylor/32/102462_2.png) [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)\
**Post date:** [October 15, 2017, 1:11am UTC](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029/5 "2017-10-15T01:11:00Z")

</div>

### TL;DR:

I don’t believe Mailgun’s mail forwarding will work as-is with Discourse. It doesn’t pass the email data in the right way and there doesn’t appear to be a way to change that on either end Mailgun nor Discourse.

* * *

### The detail

Within Mailgun’s documentation there is a [Django code example](https://documentation.mailgun.com/en/latest/quickstart-receiving.html#supported-actions-for-routes) which indicates what is passed to the HTTP endpoint by mailguns `forward` functionality.

An example payload at the bottom of [this page](http://mailgun-documentation.readthedocs.io/en/latest/api-routes.html#examples) confirms this.

For reference here is the code sample:

> Consider this Django code:
> 
> ```Django
> # Handler for HTTP POST to http://myhost.com/messages for the route defined above
> def on_incoming_message(request):
> if request.method == 'POST':
> sender = request.POST.get('sender')
> recipient = request.POST.get('recipient')
> subject = request.POST.get('subject', '')
> 
> body_plain = request.POST.get('body-plain', '')
> body_without_quotes = request.POST.get('stripped-text', '')
> # note: other MIME headers are also posted here...
> 
> # attachments:
> for key in request.FILES:
> file = request.FILES[key]
> # do something with the file
> 
> # Returned text is ignored but HTTP status code matters:
> # Mailgun wants to see 2xx, otherwise it will make another attempt in 5 minutes
> return HttpResponse('OK')
> 
> ```

Note that this means that many POST parameters including `sender`, `recipient`, `subject`, `body-plain`, `stripped-text` and files as separate “chunks”.

This is not what Discourse expects to be sent to the `/admin/email/handle_mail` endpoint - it simply wants the complete raw email as the `email` parameter.

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-with-mailgun-replies/72029)._