Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [csrf]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
11 votes
5 answers
8k views

What's the best way to skip CSRF for plugin controllers?

I'm working on a plugin that'll create a private API for content authors to post entries to Craft from desktop-based scripts. These scripts post data to plugin controller actions (anonymous-allowed), ...
Matt Stein's user avatar
  • 4,006
9 votes
2 answers
8k views

How can I use CSRF protection with AJAX routes?

I have CSRF enabled on my install. I have a bunch of frontend forms so CSRF is pretty important for me. However, when I use AJAX to post to a controller action I get the following error. <div id="...
David A McInnis's user avatar
5 votes
5 answers
4k views

How can I Prevent CSRF Tokens from being Cached?

We have a Craft site in which we include a partial that includes in several different places. CSRF is enabled, and we're appending {{ getCsrfInput() }} to the form. Because of the way we've set up ...
Peter Compernolle's user avatar
5 votes
1 answer
539 views

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We've enabled CSRF Protection on a site. When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted. Things we've ...
Ben Parizek's user avatar
  • 13.5k
4 votes
1 answer
865 views

How can I ensure using actionUrl in my template does not show script name in the generated URL?

I have an controller action in my custom plugin that processes Paypal IPN requests. How it works is that you provide a URL for Paypal to send it's notification requests to and then process them and ...
Mike Pierce's user avatar
4 votes
1 answer
1k views

Headless CraftCMS as mobile app backend, requiring login

Currently building a mobile app with Phonegap, I'm able to use the Element API for many features, but when comes the time to use Craft as a loggedin user, I run out of ideas. I read a lot of things ...
r-ninja's user avatar
  • 147
3 votes
2 answers
5k views

What is the best way to append CSRF token without using a form?

I have built a plugin that simply makes requests to a 3rd party API. I am calling my plugin action via ajax. I don't have a form on this page currently. Here is what I am using, but I am getting the ...
Damon's user avatar
  • 4,706
3 votes
1 answer
471 views

Using CRSF, AJAX form posts, with a CDN

We have a setup where we have a Contact Us page that submits a form using the plugin from P&T. We will have quite some load on the site, so want to keep all of the GET responses in a CDN cache, ...
graney's user avatar
  • 173
3 votes
1 answer
663 views

Delete CSRF cookie on submit form success

I need to delete the CRAFT_CSRF_TOKEN cookie when a form submission reaches certain/success page. I'm using CSRF stripped cookie's value to store entry title like this: {% set token = craft.request....
Dominik Krulak's user avatar
2 votes
2 answers
1k views

CSRF token using Craft as an API

Our Craft site needs to exchange data with our customer in-house APP. And at some point it needs for the APP to POST us updates. We set some sort of API with a Api and Secret Key to exchange between ...
Sylvain Tremblay's user avatar
2 votes
2 answers
5k views

Login - Bad Request: The CSRF token could not be verified

I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my /etc/hosts file on my Mac to point to the IP address for testing. Whilst checking ...
Adam Menczykowski's user avatar
2 votes
1 answer
5k views

Axios post function got 400 bad request

I created a Vue component. And in this component, I use axios to send post request when it's mounted, CSRF token also included, but still got 400 status. Anyone know why?
yu xia's user avatar
  • 397
2 votes
1 answer
1k views

JS login form on different domain and handling the CSRF token

Having sorted out the CORS issue and succesfully logging into Craft from a different domain using Javascript, I've now turned CSRF protection back on. I've got a module returning the CSRF token name ...
Clive Portman's user avatar
2 votes
1 answer
739 views

How do I test if Craft CSRF Protection is properly enabled?

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?" Let's say we pull that all off without a ...
Ben Parizek's user avatar
  • 13.5k
2 votes
1 answer
105 views

Ajax form submission forbidden error on custom plugin

I am submitting form data to 3rd party api through a custom plugin using fetch. Im setting CSRF token in form like: <input type="hidden" id="subscribe-modal-token" name="{{...
joomkit's user avatar
  • 2,024
2 votes
1 answer
2k views

400 bad request ("Unable to verify your data submission.") when Adding product to cart

When a user tries to add something into the cart the following error appears: 400 bad request ("Unable to verify your data submission.") 2021-02-23 09:08:42 [-][-][...
KSPR's user avatar
  • 3,786
2 votes
1 answer
944 views

Bad Request with weird params

I just installed Craft fresh, there's almost nothing in my DB as I'm just beginning to develop a plugin. All I want is to save a new entry from the frontend of my website. I've done this before in ...
Tom De Smet's user avatar
  • 1,456
1 vote
2 answers
2k views

Does CSRF protection for controller actions require POST?

I've got a controller action which will work as the callback URL for OAUTH authentication with an external, third-party API. After authenticating, the external API will issue a GET request to my ...
Mats Mikkel Rummelhoff's user avatar
1 vote
1 answer
790 views

Ajax post request front-end csrf token

I'm trying to make a simple post request with ajax to a controller in plugin. The problem I'm having is that I always get a 400 Bad request because I don't send a valid CSRF Token. But I can't figure ...
dazz's user avatar
  • 195
1 vote
1 answer
450 views

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. The following code appears via my master _layout.html file: <form action="" ...
Sam's user avatar
  • 421
1 vote
1 answer
263 views

Webhook Error with Charge plugin

Stripe is throwing a server error when trying to access a webhook to the Charge plugin. Some investigation revealed the error is triggered by an 'invalid or missing CSRF token.
Roi Agneta's user avatar
  • 1,463
1 vote
1 answer
158 views

Searching for a way to add products to cart and sending the csrf token with ajax

Searching for a way to add products to cart and sending the csrf token with ajax This is my current code; $('.add-to-cart-form').on('submit', function(e) { e.preventDefault() ...
Bram Beekman's user avatar
1 vote
1 answer
118 views

CSRF in plugin dashboard widget 400 error

Yes, it's another csrf question, the standard, 400 Error - Bad Request: Unable to verify your data submission. If in config/general.php I set 'enableCsrfProtection' => false, then everything works ...
kr37's user avatar
  • 1,355
1 vote
1 answer
325 views

How to add CSRF cookie directive?

I need to add the SameSite directive to my site's CSRF cookie, as explained in these mozilla security guidelines. According to the Craft docs, "Craft handles the cookie creation automatically." Is ...
Andrea Hall's user avatar
1 vote
1 answer
499 views

CSRF token is null or empty in craft 2

I'm having an issue with Craft 2.6 and the CSRF token. I enabled Csrf Protection in my general.php file by adding this line $config['*'] array so it looks like: $config['*'] = [ ... '...
WTFranklin's user avatar
1 vote
1 answer
526 views

AJAX CSRF Producing Inconsistent Results

I am using CSRF tokens in a form on CraftCMS. Submissions are successful with a standard configuration. Introducing "fresh" CSRF tokens via AJAX on page load is causing some trouble. This is ...
Chris Chapman's user avatar
1 vote
2 answers
110 views

Craft CSRF protection and Facebook Tab

I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is ...
mario's user avatar
  • 11
1 vote
1 answer
818 views

CSRF admin Login

I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"'...
Mart's user avatar
  • 13
1 vote
1 answer
395 views

CRAFT_CSRF_TOKEN is failing to write

Seeing some odd behavior in Chrome where we can no longer log into our dev site, which is currently served over HTTP. But, if we try logging in using an incognito window, it works. It looks like the ...
Jegra's user avatar
  • 81
1 vote
1 answer
332 views

SSL now CP unknown errors

I have a Craft 3 site that's been running on a production server. Recently we switched over to https but this has caused issues in the CP (multiple 'An unknown error occurred' red flags, can't view ...
Dr_Codswallop's user avatar
1 vote
1 answer
349 views

FreeForm and Vue - Hidden Forms in Modal - Manually refresh the Craft CRSF token and Freeform JS Honeypot field

Anyone using FreeForm and Vue together? I have a form that is hidden away in a modal (that is then shown using Vue) via a click of a button. Vue is only used to hide the form and show the form. the ...
Terry Upton's user avatar
  • 1,894
1 vote
1 answer
614 views

Another AJAX CSRF question

I have quite a simple registration form, something like this: <script type="text/javascript"> window.csrfTokenName = "{{ craft.config.get('csrfTokenName') }}"; window....
Tom De Smet's user avatar
  • 1,456
1 vote
3 answers
2k views

Contact Form plugin - using Ajax, CSRF 400 bad request

I am using the Contact Form plugin with AJAX. I have used the JS AJAX script supplied in the plugin but i get a 'Bad request: CSRF token could not be verified' error. I have seen many other posts on ...
ToddPadwick's user avatar
1 vote
1 answer
926 views

Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token

I have the following scenario: A page is loaded via HTTP The user fills out a form and submits its contents via HTTPS The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is ...
Clemens Sum's user avatar
1 vote
0 answers
42 views

How to append current version to post URL - versioning a post

I'm middle of a PWA app and one of the problems facing is versioning, once the post cached using Service Worker and if any change amended(ex: if it is an event post, the event end date may be extended....
Sameera Thilakasiri's user avatar
1 vote
0 answers
344 views

What's left to troubleshoot this quirky "Unable to verify your data submission" behavior?

I have a frontend login form that sends a request to Craft's own actions/users/login action. I've used this same process in another project and it works there, but not here, and I can't figure out ...
Steven Thate's user avatar
1 vote
1 answer
983 views

CSRF Protection in AJAX post

I'm having some trouble passing CSRF-tokens in my js-File in Craft 3. I'm setting the values in my template like so: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app....
bstnhnsl's user avatar
  • 123
1 vote
0 answers
852 views

How to access logged in CSRF token?

I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft ...
samput's user avatar
  • 51
1 vote
0 answers
616 views

CSRF token creation and Content-Security-Policy header

I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one. The relevant part of my .htaccess ...
rjdvsk's user avatar
  • 105
1 vote
0 answers
2k views

Can’t log in to the Craft control panel

After I input my credentials, it just stayed on the login page, and did not go to the dashboard. The password is good, we didn't get invalid username and password error. I opened the trace mode and ...
xyray's user avatar
  • 79
0 votes
1 answer
384 views

Sprig/Snaptcha CSRF issue/question

We have a site using Sprig and Snaptcha. One of our forms is always returning a 400 error "Unable to verify your data submission" which is usually a CSRF issue but thought Sprig takes care ...
Cole Henley's user avatar
  • 1,741
0 votes
1 answer
935 views

In a plugin, what's the way in PHP to output a CSRF token?

My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo? EDIT to document the final answer $token = craft()->...
kr37's user avatar
  • 1,355
0 votes
0 answers
23 views

Add to cart via Ajax (sometimes) results in abandoned carts and invalid CSRF

In Craft Commerce, I am using the Blitz Cache plugin. My "add to cart"-button uses ajax to add the product to the cart. This is the twig-code for the form: <form method="post" ...
nitech's user avatar
  • 679
0 votes
0 answers
28 views

Any way to manually validate a CSRF token on the front-end?

I'm looking to manually validate a CSRF token (passed via GET) in a template, basically as a way of rate-limiting bots accessing a page which generates a CSV file. Poking around the Craft docs and ...
Derek Hogue's user avatar
0 votes
0 answers
92 views

Email template error

In the logs, I have this error: 2021-02-01 18:00:04 [-][-][-][error][craft\commerce\services\Emails::sendEmail] Email template parse error for email “Order Submitted”. Order: “123456”. Template error:...
hackerman's user avatar
0 votes
0 answers
137 views

Q: Error 400 Bad Request on basic admin actions like admin/actions/elements/get-modal-body

Context: The client recently upgraded their Craft version along with several of their plugins. I believe this issue started post-upgrade. They are now on Craft 3.4.26. Problem: Certain admin actions, ...
Adam Tsai's user avatar
0 votes
0 answers
2k views

CSRF token could not be verified - ajax

I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with. I've read the ...
JamesNZ's user avatar
  • 947