<p>Ok - think I figured this out.  Our dev site is hosted on a sub-domain of our production site, which is served over HTTPS.  Seems like the CRAFT_CSRF_TOKEN
cookie set by our production site is the same that's trying to be set by our dev site, and since dev is served over HTTP, it's unable to overwrite the one set by the production server.  Clearing out cookies on production fixed the problem. I imagine setting up HTTPS on dev would also do the trick, but clearing the prod cookie is a quicker fix at the moment.</p>

CC BY-SA 4.0
2020-11-06T05:07:50.537Z
2020-11-06T05:07:50.537Z
Jegra
<p>Seeing some odd behavior in Chrome where we can no longer log into our dev site, which is currently served over HTTP.  But, if we try logging in using an incognito window, it works.  It looks like the CRAFT_CSRF_TOKEN cookie is not getting written - error message in the console (under headers-&gt;set-cookie) is &quot;This Set-Cookie was blocked because it was not sent over a secure connection and would have overwritten a cookie with the secure attribute&quot;. Have cleared out all cookies, but this does not help.  The login DOES work using an incognito window, but hoping to be able to get it working on a regular window as well, if possible.</p>

<login><csrf><cookies>
CRAFT_CSRF_TOKEN is failing to write
# CRAFT_CSRF_TOKEN is failing to write

(Asked by: username_0 on 2020-11-06)

Seeing some odd behavior in Chrome where we can no longer log into our dev site, which is currently served over HTTP. But, if we try logging in using an incognito window, it works. It looks like the CRAFT\_CSRF\_TOKEN cookie is not getting written - error message in the console (under headers->set-cookie) is "This Set-Cookie was blocked because it was not sent over a secure connection and would have overwritten a cookie with the secure attribute". Have cleared out all cookies, but this does not help. The login DOES work using an incognito window, but hoping to be able to get it working on a regular window as well, if possible.

**Tags:** login, csrf, cookies

---

## 1 answers

### Answer by username_0 on 2020-11-06. Score: 1

Ok - think I figured this out. Our dev site is hosted on a sub-domain of our production site, which is served over HTTPS. Seems like the CRAFT\_CSRF\_TOKEN
cookie set by our production site is the same that's trying to be set by our dev site, and since dev is served over HTTP, it's unable to overwrite the one set by the production server. Clearing out cookies on production fixed the problem. I imagine setting up HTTPS on dev would also do the trick, but clearing the prod cookie is a quicker fix at the moment.


---

