I have just tried to log into an old local Craft 3 project that hasn't been worked on in a few months and I'm getting the following:

HTTP 400 – Bad Request – yii\web\BadRequestHttpException

Unable to verify your data submission.

yii\web\BadRequestHttpException: Unable to verify your data submission. in /Users/user/Development/project/build/vendor/yiisoft/yii2/web/Controller.php:166
Stack trace:
#0 /Users/user/Development/project/build/vendor/craftcms/cms/src/web/Controller.php(82): yii\web\Controller->beforeAction(Object(yii\base\InlineAction))
#1 /Users/user/Development/project/build/vendor/yiisoft/yii2/base/Controller.php(155): craft\web\Controller->beforeAction(Object(yii\base\InlineAction))
#2 /Users/user/Development/project/build/vendor/craftcms/cms/src/web/Controller.php(103): yii\base\Controller->runAction('login', Array)
#3 /Users/user/Development/project/build/vendor/yiisoft/yii2/base/Module.php(528): craft\web\Controller->runAction('login', Array)
#4 /Users/user/Development/project/build/vendor/craftcms/cms/src/web/Application.php(282): yii\base\Module->runAction('users/login', Array)
#5 /Users/user/Development/project/build/vendor/craftcms/cms/src/web/Application.php(538): craft\web\Application->runAction('users/login', Array)
#6 /Users/user/Development/project/build/vendor/craftcms/cms/src/web/Application.php(266): craft\web\Application->_processActionRequest(Object(craft\web\Request))
#7 /Users/user/Development/project/build/vendor/yiisoft/yii2/base/Application.php(386): craft\web\Application->handleRequest(Object(craft\web\Request))
#8 /Users/user/Development/project/build/public/index.php(42): yii\base\Application->run()
#9 {main}

The front end of the site fine, the login page at /admin works and I've restarted MAMP multiple times. I have also locally run composer update in case there were any issues with my packages.

But nothing seems to make it want to successfully sign me in.


After more research, a lot of people have had their issues like this resolved by clearing the cache of their browser. I have tried this in three separate browsers all to no improvement.

  • 1
    Are you in a load-balanced web server environment?
    – Brad Bell
    Sep 2 '18 at 23:18
  • No, it’s just a local MAMP setup.
    – Jay
    Sep 3 '18 at 7:00
  • 1
    Did you try removing the cookies as well? Maybe it's related to an outdated cookie...
    – kant312
    Sep 3 '18 at 12:05
  • @kant312 I removed all browser data. Everything from cookies to history.
    – Jay
    Sep 3 '18 at 13:31
  • Thank you, Clearing my cache worked! Jan 29 '21 at 15:00

I haven't seen this particular issue but generally I've found that from time to time MAMP doesn't like running Craft in CGI mode, i.e. with different PHP versions per host.

Try switching it to module mode (under the PHP tab of MAMP Pro). If that works, then try reverting to CGI mode. You may find it continues to work.

  • Yeah, I've had this before, too. I'm always running in Module mode. Cheers
    – Jay
    Sep 4 '18 at 9:25

After discussions on Craft Slack and with Brandon on GitHub it was noticed that one component in Gulp had a path set to compile some files out into a /web directory, even after I'd changed my project to use the /public directory instead.

So I think Craft was getting confused between /public and /web.

This also lead to the /public directory having an out of date /cpresources directory and the login page was unable to match up the new CRSF token field to the set cookie without the javascript resources.


I just had this issue and I found that I caused it by setting the defaultCookieDomain to something else, than where my Craft website was running. The effect was that the CSRF cookie was never sent to my server when logging in, so CSRF failed.

Removing/updating the defaultCookieDomain setting from/in general.php file should fix the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.