We've enabled CSRF Protection on a site.
When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted.
Things we've observed:
- Some forms work, others don't
- Sometimes a browser doesn't place the CSRF cookie
- Sometimes two different browsers will have the same CSRF cookie
- Sometimes if I delete the CSRF Cookie and then refresh the browser, the cookie won't return
- Clearing the Craft cache seems to get forms working again in one browser but not another
Why are we seeing this weird behavior? What is happening?!