# Mobile development issue - Can't verify CSRF token authenticity

**URL:** https://meta.discourse.org/t/mobile-development-issue-cant-verify-csrf-token-authenticity/151670
**Category:** Development
**Created:** [May 16, 2020, 6:36am UTC](https://meta.discourse.org/t/mobile-development-issue-cant-verify-csrf-token-authenticity/151670 "2020-05-16T06:36:00Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![X\_Code](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/x_code/32/148529_2.png) [@X\_Code](https://meta.discourse.org/u/X_Code)
#### Post date: [May 16, 2020, 6:36am UTC](https://meta.discourse.org/t/mobile-development-issue-cant-verify-csrf-token-authenticity/151670/1 "2020-05-16T06:36:00Z")

</div>

Hi,  
I am trying to develop mobile app for discourse using flutter.  
I sent GET request of /session/csrf.json to get a csrf token in my mobile app. Next I added header x-csrf-token to send a POST request to upload avatar.

Server log is:

```plaintext
Started POST "/uploads.json" for 98.199.193.94 at 2020-05-16 04:34:48 +0000
Processing by UploadsController#create as JSON
  Parameters: {"type"=>"avatar", "user_id"=>"639", "files"=>[#<ActionDispatch::Http::UploadedFile:0x00007f0b57b32478 @tempfile=#<Tempfile:/tmp/RackMultipart20200516-783-12pa37a.jpg>, @original_filename="image_picker_CE009BE9-D964-459D-B59C-ABE78F1CC5DF-20639-0000AE2EE903C2FC.jpg", @content_type="application/octet-stream", @headers="content-disposition: form-data; name=\"files[]\"; filename=\"image_picker_CE009BE9-D964-459D-B59C-ABE78F1CC5DF-20639-0000AE2EE903C2FC.jpg\"\r\ncontent-type: application/octet-stream\r\n">]}
Can't verify CSRF token authenticity.

```

So what is the right way to get valid csrf token for mobile app?