I have the following scenario:

  • A page is loaded via HTTP
  • The user fills out a form and submits its contents via HTTPS
  • The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is submitted along with the form
  • Craft responds with a HTTP 400, because the Token is not valid for the request being send over HTTPS

Is there a way to use Crafts CSRF prevention feature in this scenaria? So say for example tell Craft to generate the token for an expected HTTPS request?

Regards, Clemens

1 Answer 1


Completely untested, but try setting the recently added useSecureCookies setting to false and see if that works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.