# This operation has been blocked as a potential Cross-Site Request Forgery (CSRF)

**URL:** <https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676>\
**Category:** Server\
**Tags:** server\
**Created:** [February 8, 2023, 4:48pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676 "2023-02-08T16:48:08Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ronalli](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/ronalli/32/3848_2.png) [@ronalli](https://community.apollographql.com/u/ronalli)\
**Post date:** [February 8, 2023, 4:48pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/1 "2023-02-08T16:48:08Z")

</div>

Good evening. Help me please. An error occurred while using apollo server:

“message”: “This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a ‘content-type’ header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n”,

However, using the apollo sandbox shell, there is no such error. If you make a request directly from the browser, then nothing helps.

Code:

```auto
const app = express();
const httpServer = http.createServer(app);

const server = new ApolloServer({
  typeDefs: [customTypDefs, scalarTypeDefs],
  resolvers: [customResolvers, scalarResolvers],
  plugins: [
    ApolloServerPluginLandingPageDisabled(),
    ApolloServerPluginDrainHttpServer({ httpServer }),
  ],
});
await server.start();

app.use(
  '/api/graphql',
  cors(),
  bodyParser.json(),
  expressMiddleware(server, {
    context: async ({ req }) => {
      {
        const token = req.headers.authorization;
        const user = getUser(token);
        return { models, user };
      }
    },
  })
);

await new Promise((res) => httpServer.listen({ port: PORT }, res));

console.log(`🚀 Server ready at http://localhost:${PORT}/api/graphql`);

```

---

<div class="post-metadata">

**Author:** ![glasser](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/glasser/32/48_2.png) [@glasser](https://community.apollographql.com/u/glasser)\
**Post date:** [February 8, 2023, 4:55pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/2 "2023-02-08T16:55:12Z")

</div>

Have you read the docs at [Configuring CORS - Apollo GraphQL Docs](https://www.apollographql.com/docs/apollo-server/security/cors/#preventing-cross-site-request-forgery-csrf) ?

What kind of request you making? CSRF prevention typically only kicks in on GET requests with GraphQL (because GraphQL POST requests generally provide `content-type: application/json`).

---

<div class="post-metadata">

**Author:** ![ronalli](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/ronalli/32/3848_2.png) [@ronalli](https://community.apollographql.com/u/ronalli)\
**Post date:** [February 8, 2023, 5:08pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/3 "2023-02-08T17:08:53Z")

</div>

Yes, I have already read the documentation up and down and nothing helps. I use a bunch: graphql + mongoose.

```auto
notes: async (parent, args, { models }) => await models.Note.find(),

```

```auto
newNote: async (parent, args, { models, user }) => {
    if (!user) throw new GraphQLError('You must be signed in to create a note');
    return await models.Note.create({
      content: args.content,
      author: mongoose.Types.ObjectId(user.id),
    });
  },

```

The most annoying thing is that literally 2 days ago everything worked fine, the problems started yesterday.

---

<div class="post-metadata">

**Author:** ![glasser](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/glasser/32/48_2.png) [@glasser](https://community.apollographql.com/u/glasser)\
**Post date:** [February 8, 2023, 5:44pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/4 "2023-02-08T17:44:25Z")

</div>

I’m asking about how your _client_ is set up. This has nothing to do with your resolvers and everything to do with how your client sends the message: is it GET or POST, what HTTP headers are sent, etc.

---

<div class="post-metadata">

**Author:** ![ronalli](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/ronalli/32/3848_2.png) [@ronalli](https://community.apollographql.com/u/ronalli)\
**Post date:** [February 8, 2023, 5:54pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/5 "2023-02-08T17:54:44Z")

</div>

That’s the problem, that I don’t have a client part at all, only a bare server. I made requests through the built-in apollo sandbox shell: I just typed in localhost:4000/api in the browser and tested it. Now it doesn’t work through the browser - it writes such an error, but if you register on studio apollo and add an endpoint there - everything works.

---

<div class="post-metadata">

**Author:** ![ronalli](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/ronalli/32/3848_2.png) [@ronalli](https://community.apollographql.com/u/ronalli)\
**Post date:** [February 8, 2023, 6:45pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/6 "2023-02-08T18:45:51Z")

</div>

I found what the problem is, thanks for not directly, but indirectly helping to figure it out. Good luck and have a nice day.

---

<div class="post-metadata">

**Author:** ![Royt](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@Royt](https://community.apollographql.com/u/Royt)\
**Post date:** [February 13, 2023, 6:03pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/7 "2023-02-13T18:03:35Z")

</div>

Hi Ronalli,

What was the fix? We’re getting this also!

---

<div class="post-metadata">

**Author:** ![ronalli](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/ronalli/32/3848_2.png) [@ronalli](https://community.apollographql.com/u/ronalli)\
**Post date:** [February 13, 2023, 6:22pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/8 "2023-02-13T18:22:59Z")

</div>

Hi, Royt.

I had the “helmet” library installed, which added headers to an express application. And removed the ApolloServerPluginLandingPageDisabled plugin when creating the server.

---

<div class="post-metadata">

**Author:** ![Royt](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@Royt](https://community.apollographql.com/u/Royt)\
**Post date:** [February 13, 2023, 6:55pm UTC](https://community.apollographql.com/t/this-operation-has-been-blocked-as-a-potential-cross-site-request-forgery-csrf/5676/9 "2023-02-13T18:55:08Z")

</div>

ok Thank you! I’ll check all my packages!