Skip to main content

Questions tagged [csrf]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

Add to cart via Ajax (sometimes) results in abandoned carts and invalid CSRF

In Craft Commerce, I am using the Blitz Cache plugin. My "add to cart"-button uses ajax to add the product to the cart. This is the twig-code for the form: <form method="post" ...
nitech's user avatar
  • 679
0 votes
0 answers
33 views

Any way to manually validate a CSRF token on the front-end?

I'm looking to manually validate a CSRF token (passed via GET) in a template, basically as a way of rate-limiting bots accessing a page which generates a CSV file. Poking around the Craft docs and ...
Derek Hogue's user avatar
2 votes
2 answers
1k views

CSRF token using Craft as an API

Our Craft site needs to exchange data with our customer in-house APP. And at some point it needs for the APP to POST us updates. We set some sort of API with a Api and Secret Key to exchange between ...
Sylvain Tremblay's user avatar
2 votes
1 answer
107 views

Ajax form submission forbidden error on custom plugin

I am submitting form data to 3rd party api through a custom plugin using fetch. Im setting CSRF token in form like: <input type="hidden" id="subscribe-modal-token" name="{{...
joomkit's user avatar
  • 2,034
2 votes
1 answer
2k views

400 bad request ("Unable to verify your data submission.") when Adding product to cart

When a user tries to add something into the cart the following error appears: 400 bad request ("Unable to verify your data submission.") 2021-02-23 09:08:42 [-][-][...
KSPR's user avatar
  • 3,786
0 votes
0 answers
93 views

Email template error

In the logs, I have this error: 2021-02-01 18:00:04 [-][-][-][error][craft\commerce\services\Emails::sendEmail] Email template parse error for email “Order Submitted”. Order: “123456”. Template error:...
hackerman's user avatar
1 vote
1 answer
159 views

Searching for a way to add products to cart and sending the csrf token with ajax

Searching for a way to add products to cart and sending the csrf token with ajax This is my current code; $('.add-to-cart-form').on('submit', function(e) { e.preventDefault() ...
Bram Beekman's user avatar
1 vote
1 answer
404 views

CRAFT_CSRF_TOKEN is failing to write

Seeing some odd behavior in Chrome where we can no longer log into our dev site, which is currently served over HTTP. But, if we try logging in using an incognito window, it works. It looks like the ...
Jegra's user avatar
  • 81
0 votes
0 answers
138 views

Q: Error 400 Bad Request on basic admin actions like admin/actions/elements/get-modal-body

Context: The client recently upgraded their Craft version along with several of their plugins. I believe this issue started post-upgrade. They are now on Craft 3.4.26. Problem: Certain admin actions, ...
Adam Tsai's user avatar
0 votes
1 answer
387 views

Sprig/Snaptcha CSRF issue/question

We have a site using Sprig and Snaptcha. One of our forms is always returning a 400 error "Unable to verify your data submission" which is usually a CSRF issue but thought Sprig takes care ...
Cole Henley's user avatar
  • 1,741
2 votes
1 answer
1k views

JS login form on different domain and handling the CSRF token

Having sorted out the CORS issue and succesfully logging into Craft from a different domain using Javascript, I've now turned CSRF protection back on. I've got a module returning the CSRF token name ...
Clive Portman's user avatar
1 vote
0 answers
43 views

How to append current version to post URL - versioning a post

I'm middle of a PWA app and one of the problems facing is versioning, once the post cached using Service Worker and if any change amended(ex: if it is an event post, the event end date may be extended....
Sameera Thilakasiri's user avatar
1 vote
1 answer
120 views

CSRF in plugin dashboard widget 400 error

Yes, it's another csrf question, the standard, 400 Error - Bad Request: Unable to verify your data submission. If in config/general.php I set 'enableCsrfProtection' => false, then everything works ...
kr37's user avatar
  • 1,355
1 vote
0 answers
349 views

What's left to troubleshoot this quirky "Unable to verify your data submission" behavior?

I have a frontend login form that sends a request to Craft's own actions/users/login action. I've used this same process in another project and it works there, but not here, and I can't figure out ...
Steven Thate's user avatar
1 vote
1 answer
335 views

SSL now CP unknown errors

I have a Craft 3 site that's been running on a production server. Recently we switched over to https but this has caused issues in the CP (multiple 'An unknown error occurred' red flags, can't view ...
Dr_Codswallop's user avatar
4 votes
1 answer
1k views

Headless CraftCMS as mobile app backend, requiring login

Currently building a mobile app with Phonegap, I'm able to use the Element API for many features, but when comes the time to use Craft as a loggedin user, I run out of ideas. I read a lot of things ...
r-ninja's user avatar
  • 147
1 vote
1 answer
351 views

FreeForm and Vue - Hidden Forms in Modal - Manually refresh the Craft CRSF token and Freeform JS Honeypot field

Anyone using FreeForm and Vue together? I have a form that is hidden away in a modal (that is then shown using Vue) via a click of a button. Vue is only used to hide the form and show the form. the ...
Terry Upton's user avatar
  • 1,894
1 vote
1 answer
327 views

How to add CSRF cookie directive?

I need to add the SameSite directive to my site's CSRF cookie, as explained in these mozilla security guidelines. According to the Craft docs, "Craft handles the cookie creation automatically." Is ...
Andrea Hall's user avatar
1 vote
1 answer
500 views

CSRF token is null or empty in craft 2

I'm having an issue with Craft 2.6 and the CSRF token. I enabled Csrf Protection in my general.php file by adding this line $config['*'] array so it looks like: $config['*'] = [ ... '...
WTFranklin's user avatar
1 vote
1 answer
817 views

Ajax post request front-end csrf token

I'm trying to make a simple post request with ajax to a controller in plugin. The problem I'm having is that I always get a 400 Bad request because I don't send a valid CSRF Token. But I can't figure ...
dazz's user avatar
  • 195
1 vote
1 answer
530 views

AJAX CSRF Producing Inconsistent Results

I am using CSRF tokens in a form on CraftCMS. Submissions are successful with a standard configuration. Introducing "fresh" CSRF tokens via AJAX on page load is causing some trouble. This is ...
Chris Chapman's user avatar
1 vote
2 answers
111 views

Craft CSRF protection and Facebook Tab

I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is ...
mario's user avatar
  • 11
1 vote
1 answer
615 views

Another AJAX CSRF question

I have quite a simple registration form, something like this: <script type="text/javascript"> window.csrfTokenName = "{{ craft.config.get('csrfTokenName') }}"; window....
Tom De Smet's user avatar
  • 1,456
1 vote
1 answer
992 views

CSRF Protection in AJAX post

I'm having some trouble passing CSRF-tokens in my js-File in Craft 3. I'm setting the values in my template like so: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app....
bstnhnsl's user avatar
  • 123
2 votes
1 answer
5k views

Axios post function got 400 bad request

I created a Vue component. And in this component, I use axios to send post request when it's mounted, CSRF token also included, but still got 400 status. Anyone know why?
yu xia's user avatar
  • 397
1 vote
3 answers
2k views

Contact Form plugin - using Ajax, CSRF 400 bad request

I am using the Contact Form plugin with AJAX. I have used the JS AJAX script supplied in the plugin but i get a 'Bad request: CSRF token could not be verified' error. I have seen many other posts on ...
ToddPadwick's user avatar
1 vote
0 answers
856 views

How to access logged in CSRF token?

I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft ...
samput's user avatar
  • 51
1 vote
1 answer
455 views

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. The following code appears via my master _layout.html file: <form action="" ...
Sam's user avatar
  • 421
1 vote
1 answer
264 views

Webhook Error with Charge plugin

Stripe is throwing a server error when trying to access a webhook to the Charge plugin. Some investigation revealed the error is triggered by an 'invalid or missing CSRF token.
Roi Agneta's user avatar
  • 1,463
2 votes
2 answers
5k views

Login - Bad Request: The CSRF token could not be verified

I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my /etc/hosts file on my Mac to point to the IP address for testing. Whilst checking ...
Adam Menczykowski's user avatar
1 vote
0 answers
618 views

CSRF token creation and Content-Security-Policy header

I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one. The relevant part of my .htaccess ...
rjdvsk's user avatar
  • 105
3 votes
1 answer
667 views

Delete CSRF cookie on submit form success

I need to delete the CRAFT_CSRF_TOKEN cookie when a form submission reaches certain/success page. I'm using CSRF stripped cookie's value to store entry title like this: {% set token = craft.request....
Dominik Krulak's user avatar
2 votes
1 answer
944 views

Bad Request with weird params

I just installed Craft fresh, there's almost nothing in my DB as I'm just beginning to develop a plugin. All I want is to save a new entry from the frontend of my website. I've done this before in ...
Tom De Smet's user avatar
  • 1,456
1 vote
0 answers
2k views

Can’t log in to the Craft control panel

After I input my credentials, it just stayed on the login page, and did not go to the dashboard. The password is good, we didn't get invalid username and password error. I opened the trace mode and ...
xyray's user avatar
  • 79
0 votes
0 answers
2k views

CSRF token could not be verified - ajax

I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with. I've read the ...
JamesNZ's user avatar
  • 947
3 votes
1 answer
472 views

Using CRSF, AJAX form posts, with a CDN

We have a setup where we have a Contact Us page that submits a form using the plugin from P&T. We will have quite some load on the site, so want to keep all of the GET responses in a CDN cache, ...
graney's user avatar
  • 173
1 vote
1 answer
823 views

CSRF admin Login

I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"'...
Mart's user avatar
  • 13
5 votes
5 answers
4k views

How can I Prevent CSRF Tokens from being Cached?

We have a Craft site in which we include a partial that includes in several different places. CSRF is enabled, and we're appending {{ getCsrfInput() }} to the form. Because of the way we've set up ...
Peter Compernolle's user avatar
1 vote
2 answers
2k views

Does CSRF protection for controller actions require POST?

I've got a controller action which will work as the callback URL for OAUTH authentication with an external, third-party API. After authenticating, the external API will issue a GET request to my ...
Mats Mikkel Rummelhoff's user avatar
3 votes
2 answers
5k views

What is the best way to append CSRF token without using a form?

I have built a plugin that simply makes requests to a 3rd party API. I am calling my plugin action via ajax. I don't have a form on this page currently. Here is what I am using, but I am getting the ...
Damon's user avatar
  • 4,706
0 votes
1 answer
939 views

In a plugin, what's the way in PHP to output a CSRF token?

My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo? EDIT to document the final answer $token = craft()->...
kr37's user avatar
  • 1,355
1 vote
1 answer
926 views

Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token

I have the following scenario: A page is loaded via HTTP The user fills out a form and submits its contents via HTTPS The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is ...
Clemens Sum's user avatar
9 votes
2 answers
8k views

How can I use CSRF protection with AJAX routes?

I have CSRF enabled on my install. I have a bunch of frontend forms so CSRF is pretty important for me. However, when I use AJAX to post to a controller action I get the following error. <div id="...
David A McInnis's user avatar
4 votes
1 answer
865 views

How can I ensure using actionUrl in my template does not show script name in the generated URL?

I have an controller action in my custom plugin that processes Paypal IPN requests. How it works is that you provide a URL for Paypal to send it's notification requests to and then process them and ...
Mike Pierce's user avatar
11 votes
5 answers
8k views

What's the best way to skip CSRF for plugin controllers?

I'm working on a plugin that'll create a private API for content authors to post entries to Craft from desktop-based scripts. These scripts post data to plugin controller actions (anonymous-allowed), ...
Matt Stein's user avatar
  • 4,006
5 votes
1 answer
541 views

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We've enabled CSRF Protection on a site. When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted. Things we've ...
Ben Parizek's user avatar
  • 13.5k
2 votes
1 answer
740 views

How do I test if Craft CSRF Protection is properly enabled?

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?" Let's say we pull that all off without a ...
Ben Parizek's user avatar
  • 13.5k