<p>Context:
The client recently upgraded their Craft version along with several of their plugins. I believe this issue started post-upgrade. They are now on Craft 3.4.26.</p>
<p>Problem:
Certain admin actions, like opening a modal or quick saving an entry result in an error 400. We thought it was a CSRF issue so we disabled that in general.php, but still get the same result in Chrome (oddly, disabling CSRF works in Firefox). Also oddly, there is still a cookie called CRAFT_CSRF_TOKEN and if you delete that before performing your action, it will work.</p>
<p>The last piece of information is that I began disabling plugins one by one to see if the functionality was being affected by any of them. We figured out that disabling SEOmatic (v3.3.8) resolved the issue. I've also submitted an issue with NYStudio107, but I'm curious how/why a plugin might affect basic functions of the admin like opening a modal.</p>

CC BY-SA 4.0
2020-08-03T16:23:30.277Z
Related: the SEOmatic GitHub issue: https://github.com/nystudio107/craft-seomatic/issues/704
andrew.welch
CC BY-SA 4.0
2020-09-02T18:21:36.453Z
@adam-tsai do you have multi-site enabled?
Alan Miller
CC BY-SA 4.0
2020-09-03T19:49:18.567Z
@AlanMiller No, we do not
Adam Tsai
<admin><csrf>
Q: Error 400 Bad Request on basic admin actions like admin/actions/elements/get-modal-body
# Q: Error 400 Bad Request on basic admin actions like admin/actions/elements/get-modal-body

(Asked by: username_0 on 2020-08-03)

Context:
The client recently upgraded their Craft version along with several of their plugins. I believe this issue started post-upgrade. They are now on Craft 3.4.26.

Problem:
Certain admin actions, like opening a modal or quick saving an entry result in an error 400. We thought it was a CSRF issue so we disabled that in general.php, but still get the same result in Chrome (oddly, disabling CSRF works in Firefox). Also oddly, there is still a cookie called CRAFT\_CSRF\_TOKEN and if you delete that before performing your action, it will work.

The last piece of information is that I began disabling plugins one by one to see if the functionality was being affected by any of them. We figured out that disabling SEOmatic (v3.3.8) resolved the issue. I've also submitted an issue with NYStudio107, but I'm curious how/why a plugin might affect basic functions of the admin like opening a modal.

**Tags:** admin, csrf
> **Comments:**
> **username_1**: Related: the SEOmatic GitHub issue: https://github.com/nystudio107/craft-seomatic/issues/704  
> **username_2**: @adam-tsai do you have multi-site enabled?  
> **username_0**: @AlanMiller No, we do not  

---

## 0 answers

