Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token

Question

I have the following scenario:

• A page is loaded via HTTP
• The user fills out a form and submits its contents via HTTPS
• The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is submitted along with the form
• Craft responds with a HTTP 400, because the Token is not valid for the request being send over HTTPS

Is there a way to use Crafts CSRF prevention feature in this scenaria? So say for example tell Craft to generate the token for an expected HTTPS request?

Regards, Clemens

Answer 1

Completely untested, but try setting the recently added useSecureCookies setting to false and see if that works.