# Adding CSRF header to internal post calls in Node-Red

**URL:** https://discourse.nodered.org/t/adding-csrf-header-to-internal-post-calls-in-node-red/82076
**Category:** General
**Tags:** node-red-dashboard
**Created:** [16 October 2023 08:43 UTC](https://discourse.nodered.org/t/adding-csrf-header-to-internal-post-calls-in-node-red/82076 "2023-10-16T08:43:29Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Arvinth](https://avatars.discourse-cdn.com/v4/letter/a/b38774/32.png) [@Arvinth](https://discourse.nodered.org/u/Arvinth)
#### Post date: [16 October 2023 08:43 UTC](https://discourse.nodered.org/t/adding-csrf-header-to-internal-post-calls-in-node-red/82076/1 "2023-10-16T08:43:29Z")

</div>

We are trying to add CSRF custom header to the **ui/socket.io** calls and we are finding it to do it with traditional middleware process. Is there any other way we could do that?

---

<div class="post-metadata">

### Author: ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [16 October 2023 17:14 UTC](https://discourse.nodered.org/t/adding-csrf-header-to-internal-post-calls-in-node-red/82076/2 "2023-10-16T17:14:54Z")

</div>

You are aware that you can only add custom headers to the initial connection of ws?

Once it has upgraded the connection from http(s) for the initial handshake to ws(s), custom headers are no longer available.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [15 December 2023 17:15 UTC](https://discourse.nodered.org/t/adding-csrf-header-to-internal-post-calls-in-node-red/82076/3 "2023-12-15T17:15:02Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.