We have a site using Sprig and Snaptcha. One of our forms is always returning a 400 error "Unable to verify your data submission" which is usually a CSRF issue but thought Sprig takes care of CSRF?

The only solution seems to be disabled CSRF validation so suppose question is:

  1. if we are using Snaptcha on POST form submissions would that be sufficient (eg is CSRF needed), and
  2. any thoughts why sprig might be generating or submitting an incorrect CSRF token?




1 Answer 1


From your code sample it looks like you may be using Blitz to cache the page, in which case this is likely neither a Sprig issue nor a Snaptcha issue. A CSRF token is a dynamic token which should not be statically cached. You would normally use the {{ craft.blitz.csrfInput() }} tag but since you are using Sprig, I'd recommend you look into implementing the dynamic content example instead of using the craft.blitz tags.

As an aside for future reference, you'll get better support if you can post an issue in the appropriate Github repository along with code samples and the specific version numbers of the plugins in question.

  • 1
    Can you mark this as the correct answer, assuming you are satisfied with it, so that this question appears resolved?
    – Ben Croker
    Commented Aug 22, 2021 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.