CSRF Token Error for Custom Frontend API Calls in Frappe CRM After Switching Pages (Development & Cl

Business Apps Frappe CRM
, , , ,
1

Hi Frappe Community,

I’m facing an issue related to CSRF tokens in my Frappe-based application, specifically with my custom CRM frontend/CRM Override.

  • After logging out and logging in, everything works fine when directly accessing site.local/crm.
  • However, when switching to site.local/app or any other URL and then navigating back to /crm, I encounter CSRF token errors for the custom API calls I’ve added or modified.
  • The default Frappe API calls work fine, but the CSRF issue arises for custom front-end pages or actions where I’ve made modifications.
  • Steps to reproduce:
    1. Log in to the site.
    2. Visit /crm – everything works.
    3. Visit /app or any other page, and then navigate back to /crm.
    4. CSRF token error occurs when attempting to call my custom API.
    5. Only logging out and logging back in directly to /crm solves the issue temporarily.

This happens both in development and in Frappe Cloud, and I’m unable to pinpoint the cause.

I’ve already tried:

  1. Using ignore_csrf: 1 (but this is not secure for production).
  2. Ensuring the token is set with frappe.csrf_token – but it still doesn’t get sent for custom pages.
  3. Attempting to use a fresh login flow, but the issue persists when switching between URLs.

What I need help with:

  • Understanding why CSRF tokens aren’t being sent for custom frontend pages.
  • Ensuring proper CSRF protection for these custom pages while maintaining session integrity when switching between app pages.
  • Any suggestions on workarounds or best practices for dealing with CSRF token issues in custom-built pages or apps.
2

did you get a solution to this idea? I am also facing the same during app switching

3

No, still waiting

4

hello I finally got a solution to this
I was looking every where for you

5

The behavior suggests that the custom CRM frontend may not be using the latest CSRF token after navigation, to be clear can you share?

  1. How the custom API calls are made (frappe.call, fetch, axios, etc.)?
  2. The exact CSRF error message from the Network tab or server logs?
  3. Whether /crm is a custom SPA or a standard Frappe page?
6

What worked?