Seeing some odd behavior in Chrome where we can no longer log into our dev site, which is currently served over HTTP. But, if we try logging in using an incognito window, it works. It looks like the CRAFT_CSRF_TOKEN cookie is not getting written - error message in the console (under headers->set-cookie) is "This Set-Cookie was blocked because it was not sent over a secure connection and would have overwritten a cookie with the secure attribute". Have cleared out all cookies, but this does not help. The login DOES work using an incognito window, but hoping to be able to get it working on a regular window as well, if possible.

1 Answer 1


Ok - think I figured this out. Our dev site is hosted on a sub-domain of our production site, which is served over HTTPS. Seems like the CRAFT_CSRF_TOKEN cookie set by our production site is the same that's trying to be set by our dev site, and since dev is served over HTTP, it's unable to overwrite the one set by the production server. Clearing out cookies on production fixed the problem. I imagine setting up HTTPS on dev would also do the trick, but clearing the prod cookie is a quicker fix at the moment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.