I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with.

I've read the docs on CSRF protection and specifically implemented what it says for jQuery based post submissions. However I'm still getting a 400 error saying "Bad Request - The CSRF token could not be verified." for every post request.

CSRF & 400 error

You can see a token is being sent in the post data.

  • Does this solve the problem? craftcms.stackexchange.com/questions/6580/…
    – Lindsey D
    Commented Nov 29, 2016 at 21:33
  • Hi Lindsey. Thanks for the link but no that's what I'm already doing (hence linking to that in the docs and showing the token is in the post data being send to the plugin action).
    – JamesNZ
    Commented Nov 29, 2016 at 21:57
  • Is there any caching involved here? My guess would be you're sending a token, but it's an old token.... Commented Nov 30, 2016 at 0:32
  • Hey Jeremy. No caching at this point. The token is generated on page load, then is used whenever the user interacts with the filters (meaning multiple submissions). I'm not sure if that is an issue? It doesn't work on the first one either though.
    – JamesNZ
    Commented Nov 30, 2016 at 1:37
  • Hmm, no - I just double checked but two add to carts in a row can use the same token (it's tied to the session I guess). I am pretty sure I have seen CSRF being raised as an issue when the error was something else. I presume you've turned off CSRF and made sure all is working without it? Commented Nov 30, 2016 at 2:23


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.