I am using CSRF tokens in a form on CraftCMS. Submissions are successful with a standard configuration.
Introducing "fresh" CSRF tokens via AJAX on page load is causing some trouble. This is necessary as production has caching.
Here are some observations:
- Disabling CSRF validation in
config/general.phpresolves the issue entirely; however, of course, this is not the solution.
- Disabling CSRF cookies does not resolve the issue.
- Failed attempts appear most commonly in iOS on Safari. It also occurs sometimes on Edge. It appears to work always in Chrome.
- Regarding Safari: one idea here was that the browser disrespects
Cache-Controland thinks it should be caching this request, hence resulting in a failed CSRF validation. Adding in a timestamp to the request in a query string did not resolve the issue.
- Failed attempts result in a "400 Bad Request" response. The body sometimes reads:
Bad Request: Unable to verify your data submission.
- Failed attempts occur regardless of server side caching. This has been tested on local environments (Homestead) with no non-standard caching configurations.
- The token returned on the CSRF AJAX request is different each time.
- The form is built with FreeForm, but I do not think that is of significance.
- How does one track the request further to find the reason for failure?
Any pointers here would be very appreciated. Thanks in advanced!