# ForbiddenError: invalid csrf token (EBADCSRFTOKEN)

**Code:** `invalid csrf token` · **Category:** Authentication · **Seen on:** REST API

The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie.

## Meaning

Forms and AJAX must include the token; it’s bound to the session/secret cookie. Cached pages, cookies not sent (cross-site/SameSite), session store resets and missing headers cause mismatches.

## Common causes

- Token not included in form/AJAX header
- Session or secret cookie lost (restart with memory store, SameSite)
- Page cached with an old token
- Multiple tabs/old forms

## Quick fix

1. Include the token (hidden input or X-CSRF-Token header)
2. Use a persistent session store; send cookies with credentials
3. Don’t cache pages containing tokens

## Detailed fix by platform

### JavaScript

1. `fetch("/api/profile", { method: "POST", credentials: "same-origin", headers: { "Content-Type": "application/json", "X-CSRF-Token": csrfToken }, body: JSON.stringify(data) });`

## How to diagnose

1. **Request** — Token present?
2. **Cookie** — Session/secret cookie sent?
3. **Cache** — Page cached?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/auth/invalid-csrf-token)