Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?"

Let's say we pull that all off without a hitch. Our forms output the csrfTokenName and csrfToken and the browser cookie is generated just as expected.

Now, how do we test if it is actually working? Are there any steps an average, not-very-technical developer can take to see if CSRF protection is behaving as expected?

1 Answer 1


After the page loads with the form loads, delete the CSRF cookie, then submit the form. It should fail CSRF token validation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.