Node.js 无效的csrf令牌问题快速节点JS

我第一次尝试实现csrf令牌，但遇到了一些问题。我已经做了几个小时了，还没能解决它。下面是我得到的错误：

ForbiddenError: invalid csrf token

app.js

const express = require('express')
const app = express()
const router = require('./router')
const cookieParser = require('cookie-parser')
const session = require('express-session')
const flash = require('connect-flash')
const dotenv = require('dotenv')
const csrf = require('csurf')
dotenv.config()

app.use(express.urlencoded({extended: false}))
app.use(express.json())
app.use(express.static('public'))
app.use(cookieParser('secret'))
app.use(session({
    secret: 'secret',
    cookie: {maxAge: null},
    resave: false,
    saveUninitialized: false
}))

app.use(flash())
app.set('views', 'views')
app.set('view engine', 'ejs')

app.use(csrf())
app.use(function(req, res, next) {
    res.locals.csrfToken = req.csrfToken()
    next()
})
app.use('/', router)


app.use(function (req, res, next) {
    res.status(404).render('404')
  })
app.use(function (err, req, res, next) {
    console.error(err.stack)
    res.status(500).render('404')
})

app.listen(process.env.PORT)

const express = require('express')
const multer = require('multer')
const multerConfigOpts = require('./multer.config')
const router = express.Router()
const userController = require('./controllers/userController')
const csrf = require('csurf')
var csrfProtection = csrf({ cookie: true })
// set multer configuration options
const upload = multer(multerConfigOpts)


router.get('/', userController.home)
router.get('/about', userController.about)
router.get('/employer', userController.employer)
router.get('/jobSeeker', userController.jobSeeker)
router.get('/ourProcess', userController.process)
router.get('/contact', userController.contactUs)

// Talent Request Post related routes
router.post('/talentrequest',upload.none() ,userController.requestTalent)

// Job Request Post related routs
router.post('/jobrequest', csrfProtection, upload.single('resume'), userController.requestJob)

module.exports = router

router.js

const express = require('express')
const app = express()
const router = require('./router')
const cookieParser = require('cookie-parser')
const session = require('express-session')
const flash = require('connect-flash')
const dotenv = require('dotenv')
const csrf = require('csurf')
dotenv.config()

app.use(express.urlencoded({extended: false}))
app.use(express.json())
app.use(express.static('public'))
app.use(cookieParser('secret'))
app.use(session({
    secret: 'secret',
    cookie: {maxAge: null},
    resave: false,
    saveUninitialized: false
}))

app.use(flash())
app.set('views', 'views')
app.set('view engine', 'ejs')

app.use(csrf())
app.use(function(req, res, next) {
    res.locals.csrfToken = req.csrfToken()
    next()
})
app.use('/', router)


app.use(function (req, res, next) {
    res.status(404).render('404')
  })
app.use(function (err, req, res, next) {
    console.error(err.stack)
    res.status(500).render('404')
})

app.listen(process.env.PORT)

const express = require('express')
const multer = require('multer')
const multerConfigOpts = require('./multer.config')
const router = express.Router()
const userController = require('./controllers/userController')
const csrf = require('csurf')
var csrfProtection = csrf({ cookie: true })
// set multer configuration options
const upload = multer(multerConfigOpts)


router.get('/', userController.home)
router.get('/about', userController.about)
router.get('/employer', userController.employer)
router.get('/jobSeeker', userController.jobSeeker)
router.get('/ourProcess', userController.process)
router.get('/contact', userController.contactUs)

// Talent Request Post related routes
router.post('/talentrequest',upload.none() ,userController.requestTalent)

// Job Request Post related routs
router.post('/jobrequest', csrfProtection, upload.single('resume'), userController.requestJob)

module.exports = router

我的表单示例：

            <form action="/jobrequest" method="POST" enctype="multipart/form-data">
                <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                <button type="submit" class="btn--form-submit">Submit</button>
                </div>
            </form>

提交

还有更多的数据字段，我只是不想用不必要的代码来夸大这个问题。我一直在读到其他人在表单中使用multipart时也有类似的问题，但我似乎无法理解

---

我知道我的令牌是在表单中生成的，但我不确定它是否被正确传递。任何帮助或指点都将不胜感激。谢谢

所以我可以通过在我的表单中添加以下内容并从表单中删除

输入隐藏字段

来找到解决方案

form action="/talentrequest/*?_csrf=<%= csrfToken %>*" method="POST" enctype="multipart/form-data">

formaction=“/talentrequest/*？\u csrf=*”method=“POST”enctype=“多部分/表单数据”>

一切正常。有人能解释一下这其中的潜在风险吗