Yes, it's another csrf question, the standard, 400 Error - Bad Request: Unable to verify your data submission.

If in config/general.php I set 'enableCsrfProtection' => false, then everything works nicely. So it's definitely a csrf problem.

Here's the twig template for the widget:

<script type="text/javascript">
    window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName|e('js') }}";
    window.csrfTokenValue = "{{ craft.app.request.csrfToken|e('js') }}";

and the Javascript:

$(document).ready(function () {
   var data = [];
   data[window.csrfTokenName] = window.csrfTokenValue;
   $.post('actions/livestream/main/manage-get', data, function(response, textStatus, jqXHR) {
       alert('Posted OK!'); 

I can see the csrf token value changes on page load, and as I said, without csrf enabled, the js successfully loads the widget, so, what am I doing wrong on the csrf? I don't have any element. Would that make a difference?

  • what happen if you wrap your js code in document.ready? maybe request is sent before variable assignment in twig?
    – user9975
    Apr 2, 2020 at 19:27
  • @user677900 Sorry, it is. I showed that in the question now.
    – kr37
    Apr 2, 2020 at 19:31
  • with developer tools in FF, can you see csrf param sent for that request and is it as same as window.csrfTokenValue and window.csrfTokenName in inspector tab?
    – user9975
    Apr 2, 2020 at 19:36
  • @user677900 I can see window.csrfTokenValue/Name but the params tab is blank. It says "No parameters for this request."
    – kr37
    Apr 2, 2020 at 19:48
  • 1
    Thank you so much, kind person. I've been fighting with this for three days, and now it works! If you want to post a solution, I'll accept it.
    – kr37
    Apr 2, 2020 at 20:29

1 Answer 1


as jQuery docs says you have to pass data object or string via data. so you should change

var data = [];


 var data = {};

in your code

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.