getting CSRF errors lately

I've been using passportjs for a while in my website but getting csrf error repedeatly lately.

any ideas?

```
ForbiddenError: invalid csrf token
1
at csrf (/var/www/buharmetre/node_modules/csurf/index.js, line 112 col 19)
return next(createError(403, 'invalid csrf token', {
2
at (/var/www/buharmetre/src/web/middlewares/csrf.js, line 26 col 23)
else return csrf()(req, res, next); // else set the csrf.
3
at Layer.handle [as handle_request] (/var/www/buharmetre/node_modules/express/lib/router/layer.js, line 95 col 5)
fn(req, res, next);
4
at trim_prefix (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 312 col 13)
layer.handle_request(req, res, next);
5
at (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 280 col 7)
trim_prefix(layer, layerError, layerPath, path);
6
at Function.process_params (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 330 col 12)
return done();
7
at next (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 271 col 10)
self.process_params(layer, paramcalled, req, res, function (err) {
8
at SessionStrategy.strategy.pass (/var/www/buharmetre/node_modules/passport/lib/middleware/authenticate.js, line 325 col 9)
next();
9
at SessionStrategy.authenticate (/var/www/buharmetre/node_modules/passport/lib/strategies/session.js, line 71 col 10)
self.pass();
10
at attempt (/var/www/buharmetre/node_modules/passport/lib/middleware/authenticate.js, line 348 col 16)
strategy.authenticate(req, options);
11
at authenticate (/var/www/buharmetre/node_modules/passport/lib/middleware/authenticate.js, line 349 col 7)
})(0); // attempt
12
at Layer.handle [as handle_request] (/var/www/buharmetre/node_modules/express/lib/router/layer.js, line 95 col 5)
fn(req, res, next);
13
at trim_prefix (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 312 col 13)
layer.handle_request(req, res, next);
14
at (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 280 col 7)
trim_prefix(layer, layerError, layerPath, path);
15
at Function.process_params (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 330 col 12)
return done();
16
at next (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 271 col 10)
self.process_params(layer, paramcalled, req, res, function (err) {
17
at initialize (/var/www/buharmetre/node_modules/passport/lib/middleware/initialize.js, line 53 col 5)
next();
18
at Layer.handle [as handle_request] (/var/www/buharmetre/node_modules/express/lib/router/layer.js, line 95 col 5)
fn(req, res, next);
19
at trim_prefix (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 312 col 13)
layer.handle_request(req, res, next);
20
at (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 280 col 7)
trim_prefix(layer, layerError, layerPath, path);
21
at Function.process_params (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 330 col 12)
return done();
22
at next (/var/www/buharmetre/node_modules/express/lib/router/index.js, line 271 col 10)
self.process_params(layer, paramcalled, req, res, function (err) {
23
at (/var/www/buharmetre/node_modules/express-session/index.js, line 489 col 7)
next();
24
at (/var/www/buharmetre/node_modules/continuation-local-storage/context.js, line 84 col 17)
return fn.apply(this, arguments);
25
at tryCatcher (/var/www/buharmetre/node_modules/bluebird/js/release/util.js, line 16 col 23)
return target.apply(this, arguments);
26
at Promise.successAdapter (/var/www/buharmetre/node_modules/bluebird/js/release/nodeify.js, line 22 col 30)
? tryCatch(nodeback).call(receiver, null)
27
at Promise.instrumented (/var/www/buharmetre/node_modules/opbeat/lib/instrumentation/index.js, line 102 col 27)
var result = original.apply(this, arguments)
28
at Promise.instrumented (/var/www/buharmetre/node_modules/opbeat/lib/instrumentation/index.js, line 102 col 27)
var result = original.apply(this, arguments)
29
at Promise._fulfillmentHandler0 (/var/www/buharmetre/node_modules/continuation-local-storage/context.js, line 84 col 17)
return fn.apply(this, arguments);
30
at Promise._settlePromise (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 564 col 21)
handler.call(receiver, value, promise);
31
at Promise._settlePromise0 (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 612 col 10)
this._settlePromise(promise, handler, receiver, value);
32
at Promise._settlePromises (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 691 col 18)
this._settlePromise0(this._fulfillmentHandler0, value, bitField);
33
at Promise._fulfill (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 636 col 18)
this._settlePromises();
34
at Promise._resolveCallback (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 431 col 57)
if (!(maybePromise instanceof Promise)) return this._fulfill(value);
35
at Promise._settlePromiseFromHandler (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 522 col 17)
promise._resolveCallback(x);
36
at Promise._settlePromise (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 567 col 18)
this._settlePromiseFromHandler(handler, receiver, value, promise);
37
at Promise._settlePromise0 (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 612 col 10)
this._settlePromise(promise, handler, receiver, value);
38
at Promise._settlePromises (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 691 col 18)
this._settlePromise0(this._fulfillmentHandler0, value, bitField);
39
at Promise._fulfill (/var/www/buharmetre/node_modules/bluebird/js/release/promise.js, line 636 col 18)
this._settlePromises();
40
at (/var/www/buharmetre/node_modules/bluebird/js/release/nodeback.js, line 42 col 21)
promise._fulfill(value);
41
at handleCallback (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb/lib/utils.js, line 95 col 56)
return value2 ? callback(err, value1, value2) : callback(err, value1);
42
at (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb/lib/collection.js, line 1406 col 5)
handleCallback(callback, null, item);
43
at handleCallback (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb/lib/utils.js, line 95 col 56)
return value2 ? callback(err, value1, value2) : callback(err, value1);
44
at (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb/lib/cursor.js, line 674 col 5)
handleCallback(callback, null, doc);
45
at handleCallback (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb-core/lib/cursor.js, line 171 col 5)
callback(err, result);
46
at setCursorNotified (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb-core/lib/cursor.js, line 515 col 3)
handleCallback(callback, null, null);
47
at (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb-core/lib/cursor.js, line 590 col 16)
return setCursorNotified(self, callback);
48
at queryCallback (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb-core/lib/cursor.js, line 232 col 18)
return callback(null, null);
49
at (/var/www/buharmetre/node_modules/mongoose/node_modules/mongodb-core/lib/connection/pool.js, line 455 col 18)
return cb(err, result);
50
at instrumented (/var/www/buharmetre/node_modules/opbeat/lib/instrumentation/index.js, line 102 col 27)
var result = original.apply(this, arguments)
+ 1 non-project frame
52
at _combinedTickCallback (internal/process/next_tick.js, line 67 col 7)
53
at process._tickDomainCallback [as _tickCallback] (internal/process/next_tick.js, line 122 col 9)
```

Start by reviewing the reported stack trace and reproducing the invalid token at src/web/middlewares/csrf.js, line 26, alongside the Passport and Express middleware entries shown. Done would require identifying the cause of the repeated CSRF failures and documenting a reproducible fix or regression test; no Passport repository test or target file is named.

Written by the indexing model from the issue text.