<p>Completely untested, but try setting the recently added <a href="http://buildwithcraft.com/docs/config-settings#useSecureCookies" rel="nofollow">useSecureCookies</a> setting to <code>false</code> and see if that works.</p>

CC BY-SA 3.0
2015-03-12T16:57:09.513Z
2015-03-12T16:57:09.513Z
Brad Bell
<p>I have the following scenario:</p>

<ul>
<li>A page is loaded via HTTP</li>
<li>The user fills out a form and submits its contents via HTTPS</li>
<li>The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is submitted along with the form</li>
<li>Craft responds with a HTTP 400, because the Token is not valid for the request being send over HTTPS</li>
</ul>

<p>Is there a way to use Crafts CSRF prevention feature in this scenaria? So say for example tell Craft to generate the token for an expected HTTPS request?</p>

<p>Regards,
Clemens</p>

<csrf><https>
Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token
# Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token

(Asked by: username_0 on 2015-02-27)

I have the following scenario:

* A page is loaded via HTTP
* The user fills out a form and submits its contents via HTTPS
* The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is submitted along with the form
* Craft responds with a HTTP 400, because the Token is not valid for the request being send over HTTPS

Is there a way to use Crafts CSRF prevention feature in this scenaria? So say for example tell Craft to generate the token for an expected HTTPS request?

Regards,
Clemens

**Tags:** csrf, https

---

## 1 answers

### Answer by username_1 on 2015-03-12. Score: 1

Completely untested, but try setting the recently added [useSecureCookies](http://buildwithcraft.com/docs/config-settings#useSecureCookies) setting to `false` and see if that works.


---

