<p>If you're using any kind of caching such as Nginx fastCGI static caching/Blitz/Craft's <code>{% cache %}</code> tags/Varnish etc, then you'll need to find a way to generate a fresh CSRF token in the hidden CSRF input in each form for each unique site visitor. Typically you'd do this by making a JS fetch request  to an uncached template that returns the CSRF token on each page load and then inject the value into all the CSRF inputs. Here's an example from my boilerplate:
<a href="https://github.com/cld-agency/craftwind-boilerplate/blob/craft-4/src/js/main.js#L27" rel="nofollow noreferrer">https://github.com/cld-agency/craftwind-boilerplate/blob/craft-4/src/js/main.js#L27</a></p>
<p>For the sake of completeness, if you're using Freeform, you'll also need to refresh the form hash as per Solspace's instructions here: <a href="https://docs.solspace.com/craft/freeform/v4/templates/caching/" rel="nofollow noreferrer">https://docs.solspace.com/craft/freeform/v4/templates/caching/</a></p>

CC BY-SA 4.0
2023-11-27T18:18:12.963Z
The official documentation also has an example of [fetching a fresh CSRF token](https://craftcms.com/docs/4.x/dev/controller-actions.html#ajax).
August Miller
CC BY-SA 4.0
2023-11-27T09:23:17.850Z
2023-11-27T09:23:17.850Z
James Smith
<h3>Description</h3>
<p>I am using the contact form and it works in my Brave browser but in Safari and Chrome the form will not send. It used to work fine, so I don't know what has changed. If there is a quick work around without having to wait for a plugin update, that would be great, since it seems to be a browser specific issue. I am getting the following error: Unable to verify your data submission.</p>
<pre><code>in /htdocs/vendor/yiisoft/yii2/web/Controller.phpat line 220
211212213214215216217218219220221222223224225226227228229    }
 
    /**
     * {@inheritdoc}
     */
    public function beforeAction($action)
    {
        if (parent::beforeAction($action)) {
            if ($this-&gt;enableCsrfValidation &amp;&amp; Yii::$app-&gt;getErrorHandler()-&gt;exception === null &amp;&amp; !$this-&gt;request-&gt;validateCsrfToken()) {
                throw new BadRequestHttpException(Yii::t('yii', 'Unable to verify your data submission.'));
            }
 
            return true;
        }
 
        return false;
    }
 
    /**
2. in /htdocs/vendor/craftcms/cms/src/web/Controller.php at line 171– [yii\web\Controller::beforeAction](https://www.yiiframework.com/doc-2.0/yii-web-controller.html#beforeAction()-detail)(yii\base\InlineAction)
165166167168169170171172173174175176177    {
        // Don't enable CSRF validation for Live Preview requests
        if ($this-&gt;request-&gt;getIsLivePreview()) {
            $this-&gt;enableCsrfValidation = false;
        }
 
        if (!parent::beforeAction($action)) {
            return false;
        }
 
        $this-&gt;_enforceAllowAnonymous($action);
 
        return true;
3. in /htdocs/vendor/yiisoft/yii2/base/Controller.php at line 176– craft\web\Controller::beforeAction(yii\base\InlineAction)
4. in /htdocs/vendor/yiisoft/yii2/base/Module.php at line 552– [yii\base\Controller::runAction](https://www.yiiframework.com/doc-2.0/yii-base-controller.html#runAction()-detail)('', ['p' =&gt; 'academy'])
5. in /htdocs/vendor/craftcms/cms/src/web/Application.php at line 305– [yii\base\Module::runAction](https://www.yiiframework.com/doc-2.0/yii-base-module.html#runAction()-detail)('contact-form/send', ['p' =&gt; 'academy'])
299300301302303304305306307308309310311     * @param string $route
     * @param array $params
     * @return Response|null The result of the action, normalized into a Response object
     */
    public function runAction($route, $params = []): ?BaseResponse
    {
        $result = parent::runAction($route, $params);
 
        if ($result === null || $result instanceof Response) {
            return $result;
        }
 
        $response = $this-&gt;getResponse();
6. in /htdocs/vendor/craftcms/cms/src/web/Application.php at line 608– craft\web\Application::runAction('contact-form/send', ['p' =&gt; 'academy'])
602603604605606607608609610611612613614        if ($request-&gt;getIsActionRequest()) {
            $route = implode('/', $request-&gt;getActionSegments());
 
            try {
                Craft::debug(&quot;Route requested: '$route'&quot;, __METHOD__);
                $this-&gt;requestedRoute = $route;
                return $this-&gt;runAction($route, $_GET);
            } catch (Throwable $e) {
                $this-&gt;_unregisterDebugModule();
                if ($e instanceof InvalidRouteException) {
                    throw new NotFoundHttpException(Craft::t('yii', 'Page not found.'), $e-&gt;getCode(), $e);
                }
                throw $e;
7. in /htdocs/vendor/craftcms/cms/src/web/Application.php at line 284– craft\web\Application::_processActionRequest(craft\web\Request)
278279280281282283284285286287288289290                    throw new ForbiddenHttpException();
                }
            }
        }
 
        // If this is an action request, call the controller
        if (($response = $this-&gt;_processActionRequest($request)) !== null) {
            return $response;
        }
 
        // If we’re still here, finally let Yii do its thing.
        try {
            return parent::handleRequest($request);
8. in /htdocs/vendor/yiisoft/yii2/base/Application.php at line 384– craft\web\Application::handleRequest(craft\web\Request)
9. in /htdocs/web/index.php at line 23– [yii\base\Application::run](https://www.yiiframework.com/doc-2.0/yii-base-application.html#run()-detail)()
17181920212223}
 
// Load and run Craft
define('CRAFT_ENVIRONMENT', getenv('ENVIRONMENT') ?: 'production');
/** @var craft\web\Application $app */
$app = require CRAFT_VENDOR_PATH.'/craftcms/cms/bootstrap/web.php';
$app-&gt;run();
$_GET = [
    'p' =&gt; 'academy',
];

$_POST = [
    'CRAFT_CSRF_TOKEN' =&gt; 'I8Ge6gfYDwDFoAfCHuyYidPquFiomw6sN2dsqw4gYnih9e0aJVgbCfcdAE4wF-F_f8gTQJBEgIv1Za5vqlpPsDVpgIE7ZISp92faioddTwJ32ZrGxWneVU_Vw2Ixm2XRUVdDPw1WCf6mhqAai3WHdeqLxkeLreYEsfjO1HJ--rZFJUXXTQYnzZaTfMzdO_LpX2ShTKenmEzvTDicmTSQKKDQ3eCB9zHp_UDmAjcZz0hCVx3nnro3dBl5JIt7NH0JJtNMTqtwJqR8s-iXV5wKnmx71QQMseAOUeaflVDtsrFsLTJO6Kr1oFzvbC6z81RQ_gPpMGB6Cj1vb8_C6cYj-T6wNtLS_3TZm6pM5culmxs_nPgPEBWiKUBF-PPVF5vwarOLchiQ',
    'action' =&gt; 'contact-form/send',
    'fromName' =&gt; 'Mat',
    'message' =&gt; [
        'lastName' =&gt; 'Test',
        'Address' =&gt; 'Street 4',
        'Phone' =&gt; '3234',
        'body' =&gt; 'Test',
        'subject' =&gt; '13a2d79f3d0502dda6a739b25c62590dde66c880f8d028d2e05d9b3b215ae838Ihr Anmeldung für die KWMM Academy',
    ],
    'fromEmail' =&gt; 'arentsen@tuta.io',
    'subject' =&gt; 'Anmeldung Academy',
];

$_COOKIE = [
    '_ga' =&gt; 'GA1.1.1886405093.1700471866',
    '_ga_6CHHVG88Y8' =&gt; 'GS1.1.1700471865.1.1.1700471905.0.0.0',
    'CraftSessionId' =&gt; '24a3f6c5aa12f1ba61593ec364728aab',
    '1031b8c41dfff97a311a7ac99863bdc5_identity' =&gt; '65d3e26ed3ae6f779769ad79d26e3ee83755c26a530cae8b8f3a5b49e20b4c14a:2:{i:0;s:41:&quot;1031b8c41dfff97a311a7ac99863bdc5_identity&quot;;i:1;s:162:&quot;[1,&quot;[\\&quot;9SA8TkDCAzXaxPtZTVeMf3Uk0rgfkJ6O09GSsPwoxuZrG_uCtTqmDebVSLUwHIHJkYxPFEjbjVKmH3JkAIAz54Qp8_awxGuQph75\\&quot;,null,\\&quot;eede85db4b43e095858cc613d9c48e11\\&quot;]&quot;,1209600]&quot;;}',
    'CRAFT_CSRF_TOKEN' =&gt; '11221cc31f3076f3b553cfafe50b5b0e8f53b56263aeed5124310007ed4588cea:2:{i:0;s:16:&quot;CRAFT_CSRF_TOKEN&quot;;i:1;s:147:&quot;_dvJ4tSSzIr92BTAZQ0iZ3R_V08c950-EzUVKsPf|65484ce0f5020c859afbc82f5e02fd8a7c43d6eb49629c0dedf9cd472178e251_dvJ4tSSzIr92BTAZQ0iZ3R_V08c950-EzUVKsPf|1&quot;;}',
    '1031b8c41dfff97a311a7ac99863bdc5_username' =&gt; 'ec3ef95ad492bdba655f6007f92ecb3fce265bc3943934474a8a8e4f2f1ed1dba:2:{i:0;s:41:&quot;1031b8c41dfff97a311a7ac99863bdc5_username&quot;;i:1;s:5:&quot;admin&quot;;}',
];

$_SESSION = [
    'bd62416aa8538ede709019a5e113eea5__flash' =&gt; [],
    '1031b8c41dfff97a311a7ac99863bdc5__token' =&gt; '9SA8TkDCAzXaxPtZTVeMf3Uk0rgfkJ6O09GSsPwoxuZrG_uCtTqmDebVSLUwHIHJkYxPFEjbjVKmH3JkAIAz54Qp8_awxGuQph75',
    '1031b8c41dfff97a311a7ac99863bdc5__id' =&gt; 1,
    '__authKey' =&gt; '[&quot;9SA8TkDCAzXaxPtZTVeMf3Uk0rgfkJ6O09GSsPwoxuZrG_uCtTqmDebVSLUwHIHJkYxPFEjbjVKmH3JkAIAz54Qp8_awxGuQph75&quot;,null,&quot;eede85db4b43e095858cc613d9c48e11&quot;]',
    '1031b8c41dfff97a311a7ac99863bdc5__expire' =&gt; 1701681559,
    '__duration' =&gt; 1209600,
];
</code></pre>
<p>My template is as follows:</p>
<pre><code>{% macro errorList(errors) %}
    {% if errors %}
        {{ ul(errors, {class: 'errors'}) }}
    {% endif %}
{% endmacro %}

{% set message = message ?? null %}

{% if craft.app.session.hasFlash('notice') %}
    &lt;p class=&quot;message notice&quot;&gt;{{ craft.app.session.getFlash('notice')|t }}&lt;/p&gt;
{% elseif craft.app.session.hasFlash('error') %}
    &lt;p class=&quot;message error&quot;&gt;{{ craft.app.session.getFlash('error')|t }}&lt;/p&gt;
{% endif %}

{% if craft.app.session.hasFlash('notice') %}
{% else %}
    
    &lt;form method=&quot;post&quot; action=&quot;&quot; accept-charset=&quot;UTF-8&quot; id=&quot;academy-form&quot;&gt;
        {{ csrfInput() }}
        {{ actionInput('contact-form/send') }}
        {#{ redirectInput('contact/thanks') }#}

        &lt;div class=&quot;w-full flex flex-wrap&quot;&gt;
            &lt;div class=&quot;w-full md:w-1/2 mb-2 pr-2&quot;&gt;
                &lt;label for=&quot;from-name&quot;&gt;* {{ &quot;Vorname&quot;|t }}&lt;/label&gt;
                {{ input('text', 'fromName', message.fromName ?? '', {
                    id: 'from-name',
                    autocomplete: 'name',
                    class: 'border-2 p-1 w-full',
                    required: true,
                }) }}
                {{ message ? _self.errorList(message.getErrors('firstName')) }}
            &lt;/div&gt;
            &lt;div class=&quot;w-full md:w-1/2 mb-2 pr-2&quot;&gt;
                &lt;label for=&quot;lastName&quot;&gt;* {{ &quot;Nachname&quot;|t }}&lt;/label&gt;
                &lt;input class='border-2 p-1 w-full' id=&quot;lastName&quot; type=&quot;text&quot; name=&quot;message[lastName]&quot; REQUIRED value=&quot;&quot;&gt;
            &lt;/div&gt;
            &lt;div class=&quot;w-full mb-2 pr-2&quot;&gt;
                &lt;label for=&quot;phone&quot;&gt;* {{ &quot;Adresse&quot;|t }}&lt;/label&gt;
                &lt;input class='border-2 p-1 w-full' id=&quot;phone&quot; type=&quot;text&quot; name=&quot;message[Address]&quot; REQUIRED value=&quot;&quot;&gt;
            &lt;/div&gt;

            &lt;div class=&quot;w-full md:w-1/2 mb-2 pr-2&quot;&gt;
                &lt;label for=&quot;from-email&quot;&gt;* Email&lt;/label&gt;
                {{ input('email', 'fromEmail', message.fromEmail ?? '', {
                    id: 'from-email',
                    autocomplete: 'email',
                    class: 'border-2 p-1 w-full',
                    required : true,
                }) }}
                {{ message ? _self.errorList(message.getErrors('fromEmail')) }}
            &lt;/div&gt;
            &lt;div class=&quot;w-full md:w-1/2 mb-2 pr-2&quot;&gt;
                &lt;label for=&quot;phone&quot;&gt;* {{ &quot;Telefon&quot;|t }}&lt;/label&gt;
                &lt;input class='border-2 p-1 w-full' id=&quot;phone&quot; type=&quot;text&quot; REQUIRED name=&quot;message[Phone]&quot; value=&quot;&quot;&gt;
            &lt;/div&gt;

            &lt;div class=&quot;w-full mb-4 pr-2 mt-2&quot;&gt;
                {# I sign up for #}
                &lt;div class=&quot;mb-0&quot;&gt;{{ entry.signupText|default }}&lt;/div&gt;

                {% for row in entry.checkboxOptions %}  
                    &lt;div class=&quot;w-full &quot;&gt;&lt;label class=&quot;ml-2 inline-block cursor-pointer&quot;&gt;&lt;input class=&quot;cursor-pointer px-2 w-3 h-3 text-kworange-400 bg-gray-100 border-gray-300 rounded focus:ring-kworange-400 dark:focus:ring-kworange-400 dark:ring-offset-gray-800 focus:ring-2 dark:bg-gray-700 dark:border-gray-600&quot; style=&quot;accent-color:#FE4D11;&quot; type=&quot;checkbox&quot; name=&quot;message[Courses][]&quot; value=&quot;{{ row.col1 ? row.col1 }}&quot;&gt; {{ row.col1 ? row.col1 }}&lt;/label&gt;&lt;/div&gt;
                {% endfor %}

                {{ message ? _self.errorList(message.getErrors('message')) }}
            &lt;/div&gt;
            &lt;div class=&quot;w-full mb-2 pr-2&quot;&gt;
                &lt;label for=&quot;message&quot;&gt;* {{ entry.messageText }}&lt;/label&gt;
                &lt;textarea class=&quot;border-2 p-1 w-full&quot; rows=&quot;5&quot; cols=&quot;40&quot; id=&quot;message&quot; name=&quot;message[body]&quot; REQUIRED&gt;{{ message.message.body ?? '' }}&lt;/textarea&gt;
            &lt;/div&gt;
            
        {{ input('hidden', 'subject', &quot;Anmeldung&quot; ?? '', {
            id: 'subject',
        }) }}

        &lt;input type=&quot;hidden&quot; name=&quot;message[subject]&quot; value=&quot;{{ 'Ihr Anmeldung'|hash }}&quot;&gt;
            &lt;div class=&quot;w-full mb-2 pr-2&quot;&gt;&lt;button class='border-2 px-2 py-1 hover:bg-kworange-400 hover:text-white hover:border-kworange-400' type=&quot;submit&quot;&gt;{{ &quot;Senden&quot;|t }}&lt;/button&gt;&lt;/div&gt;
        &lt;/div&gt;
    &lt;/form&gt;
{% endif %}
&lt;div class=&quot;w-full pt-4&quot;&gt;{{ entry.formAfterText|default }}&lt;/div&gt;
 &lt;div class=&quot;w-full&quot; id=&quot;thanks&quot;&gt;&lt;/div&gt;
</code></pre>
<h3>Versions</h3>
<p>Craft: 4.5.10<br>
Contact-form: 3.0.1<br>
Contact-form extensions: 4.2.2<br></p>

CC BY-SA 4.0
2023-11-20T11:48:30.937Z
Are you using any caching?
James Smith
CC BY-SA 4.0
2023-11-24T21:43:40.200Z
Yes, that's it, now it works, thanks so much!
Matthias
CC BY-SA 4.0
2023-11-27T09:24:41.723Z
Ok cool, I'll add it as an answer so we can close out properly.
James Smith
<plugin-contactform>
Contact form plugin: Unable to verify your data submission (in Safari and Chrome)
# Contact form plugin: Unable to verify your data submission (in Safari and Chrome)

(Asked by: username_0 on 2023-11-20)

Description
I am using the contact form and it works in my Brave browser but in Safari and Chrome the form will not send. It used to work fine, so I don't know what has changed. If there is a quick work around without having to wait for a plugin update, that would be great, since it seems to be a browser specific issue. I am getting the following error: Unable to verify your data submission.
in /htdocs/vendor/yiisoft/yii2/web/Controller.phpat line 220
211212213214215216217218219220221222223224225226227228229    }
 
    /**
     * {@inheritdoc}
     */
    public function beforeAction($action)
    {
        if (parent::beforeAction($action)) {
            if ($this->enableCsrfValidation && Yii::$app->getErrorHandler()->exception === null && !$this->request->validateCsrfToken()) {
                throw new BadRequestHttpException(Yii::t('yii', 'Unable to verify your data submission.'));
            }
 
            return true;
        }
 
        return false;
    }
 
    /**
2. in /htdocs/vendor/craftcms/cms/src/web/Controller.php at line 171– [yii\web\Controller::beforeAction](https://www.yiiframework.com/doc-2.0/yii-web-controller.html#beforeAction()-detail)(yii\base\InlineAction)
165166167168169170171172173174175176177    {
        // Don't enable CSRF validation for Live Preview requests
        if ($this->request->getIsLivePreview()) {
            $this->enableCsrfValidation = false;
        }
 
        if (!parent::beforeAction($action)) {
            return false;
        }
 
        $this->_enforceAllowAnonymous($action);
 
        return true;
3. in /htdocs/vendor/yiisoft/yii2/base/Controller.php at line 176– craft\web\Controller::beforeAction(yii\base\InlineAction)
4. in /htdocs/vendor/yiisoft/yii2/base/Module.php at line 552– [yii\base\Controller::runAction](https://www.yiiframework.com/doc-2.0/yii-base-controller.html#runAction()-detail)('', ['p' => 'academy'])
5. in /htdocs/vendor/craftcms/cms/src/web/Application.php at line 305– [yii\base\Module::runAction](https://www.yiiframework.com/doc-2.0/yii-base-module.html#runAction()-detail)('contact-form/send', ['p' => 'academy'])
299300301302303304305306307308309310311     * @param string $route
     * @param array $params
     * @return Response|null The result of the action, normalized into a Response object
     */
    public function runAction($route, $params = []): ?BaseResponse
    {
        $result = parent::runAction($route, $params);
 
        if ($result === null || $result instanceof Response) {
            return $result;
        }
 
        $response = $this->getResponse();
6. in /htdocs/vendor/craftcms/cms/src/web/Application.php at line 608– craft\web\Application::runAction('contact-form/send', ['p' => 'academy'])
602603604605606607608609610611612613614        if ($request->getIsActionRequest()) {
            $route = implode('/', $request->getActionSegments());
 
            try {
                Craft::debug("Route requested: '$route'", __METHOD__);
                $this->requestedRoute = $route;
                return $this->runAction($route, $_GET);
            } catch (Throwable $e) {
                $this->_unregisterDebugModule();
                if ($e instanceof InvalidRouteException) {
                    throw new NotFoundHttpException(Craft::t('yii', 'Page not found.'), $e->getCode(), $e);
                }
                throw $e;
7. in /htdocs/vendor/craftcms/cms/src/web/Application.php at line 284– craft\web\Application::_processActionRequest(craft\web\Request)
278279280281282283284285286287288289290                    throw new ForbiddenHttpException();
                }
            }
        }
 
        // If this is an action request, call the controller
        if (($response = $this->_processActionRequest($request)) !== null) {
            return $response;
        }
 
        // If we’re still here, finally let Yii do its thing.
        try {
            return parent::handleRequest($request);
8. in /htdocs/vendor/yiisoft/yii2/base/Application.php at line 384– craft\web\Application::handleRequest(craft\web\Request)
9. in /htdocs/web/index.php at line 23– [yii\base\Application::run](https://www.yiiframework.com/doc-2.0/yii-base-application.html#run()-detail)()
17181920212223}
 
// Load and run Craft
define('CRAFT_ENVIRONMENT', getenv('ENVIRONMENT') ?: 'production');
/** @var craft\web\Application $app */
$app = require CRAFT_VENDOR_PATH.'/craftcms/cms/bootstrap/web.php';
$app->run();
$_GET = [
    'p' => 'academy',
];

$_POST = [
    'CRAFT_CSRF_TOKEN' => 'I8Ge6gfYDwDFoAfCHuyYidPquFiomw6sN2dsqw4gYnih9e0aJVgbCfcdAE4wF-F_f8gTQJBEgIv1Za5vqlpPsDVpgIE7ZISp92faioddTwJ32ZrGxWneVU_Vw2Ixm2XRUVdDPw1WCf6mhqAai3WHdeqLxkeLreYEsfjO1HJ--rZFJUXXTQYnzZaTfMzdO_LpX2ShTKenmEzvTDicmTSQKKDQ3eCB9zHp_UDmAjcZz0hCVx3nnro3dBl5JIt7NH0JJtNMTqtwJqR8s-iXV5wKnmx71QQMseAOUeaflVDtsrFsLTJO6Kr1oFzvbC6z81RQ_gPpMGB6Cj1vb8_C6cYj-T6wNtLS_3TZm6pM5culmxs_nPgPEBWiKUBF-PPVF5vwarOLchiQ',
    'action' => 'contact-form/send',
    'fromName' => 'Mat',
    'message' => [
        'lastName' => 'Test',
        'Address' => 'Street 4',
        'Phone' => '3234',
        'body' => 'Test',
        'subject' => '13a2d79f3d0502dda6a739b25c62590dde66c880f8d028d2e05d9b3b215ae838Ihr Anmeldung für die KWMM Academy',
    ],
    'fromEmail' => 'arentsen@tuta.io',
    'subject' => 'Anmeldung Academy',
];

$_COOKIE = [
    '_ga' => 'GA1.1.1886405093.1700471866',
    '_ga_6CHHVG88Y8' => 'GS1.1.1700471865.1.1.1700471905.0.0.0',
    'CraftSessionId' => '24a3f6c5aa12f1ba61593ec364728aab',
    '1031b8c41dfff97a311a7ac99863bdc5_identity' => '65d3e26ed3ae6f779769ad79d26e3ee83755c26a530cae8b8f3a5b49e20b4c14a:2:{i:0;s:41:"1031b8c41dfff97a311a7ac99863bdc5_identity";i:1;s:162:"[1,"[\\"9SA8TkDCAzXaxPtZTVeMf3Uk0rgfkJ6O09GSsPwoxuZrG_uCtTqmDebVSLUwHIHJkYxPFEjbjVKmH3JkAIAz54Qp8_awxGuQph75\\",null,\\"eede85db4b43e095858cc613d9c48e11\\"]",1209600]";}',
    'CRAFT_CSRF_TOKEN' => '11221cc31f3076f3b553cfafe50b5b0e8f53b56263aeed5124310007ed4588cea:2:{i:0;s:16:"CRAFT_CSRF_TOKEN";i:1;s:147:"_dvJ4tSSzIr92BTAZQ0iZ3R_V08c950-EzUVKsPf|65484ce0f5020c859afbc82f5e02fd8a7c43d6eb49629c0dedf9cd472178e251_dvJ4tSSzIr92BTAZQ0iZ3R_V08c950-EzUVKsPf|1";}',
    '1031b8c41dfff97a311a7ac99863bdc5_username' => 'ec3ef95ad492bdba655f6007f92ecb3fce265bc3943934474a8a8e4f2f1ed1dba:2:{i:0;s:41:"1031b8c41dfff97a311a7ac99863bdc5_username";i:1;s:5:"admin";}',
];

$_SESSION = [
    'bd62416aa8538ede709019a5e113eea5__flash' => [],
    '1031b8c41dfff97a311a7ac99863bdc5__token' => '9SA8TkDCAzXaxPtZTVeMf3Uk0rgfkJ6O09GSsPwoxuZrG_uCtTqmDebVSLUwHIHJkYxPFEjbjVKmH3JkAIAz54Qp8_awxGuQph75',
    '1031b8c41dfff97a311a7ac99863bdc5__id' => 1,
    '__authKey' => '["9SA8TkDCAzXaxPtZTVeMf3Uk0rgfkJ6O09GSsPwoxuZrG_uCtTqmDebVSLUwHIHJkYxPFEjbjVKmH3JkAIAz54Qp8_awxGuQph75",null,"eede85db4b43e095858cc613d9c48e11"]',
    '1031b8c41dfff97a311a7ac99863bdc5__expire' => 1701681559,
    '__duration' => 1209600,
];

My template is as follows:
{% macro errorList(errors) %}
    {% if errors %}
        {{ ul(errors, {class: 'errors'}) }}
    {% endif %}
{% endmacro %}

{% set message = message ?? null %}

{% if craft.app.session.hasFlash('notice') %}
    {{ craft.app.session.getFlash('notice')|t }}
{% elseif craft.app.session.hasFlash('error') %}
    {{ craft.app.session.getFlash('error')|t }}
{% endif %}

{% if craft.app.session.hasFlash('notice') %}
{% else %}
    
    
        {{ csrfInput() }}
        {{ actionInput('contact-form/send') }}
        {#{ redirectInput('contact/thanks') }#}

        
            
                * {{ "Vorname"|t }}
                {{ input('text', 'fromName', message.fromName ?? '', {
                    id: 'from-name',
                    autocomplete: 'name',
                    class: 'border-2 p-1 w-full',
                    required: true,
                }) }}
                {{ message ? _self.errorList(message.getErrors('firstName')) }}
            
            
                * {{ "Nachname"|t }}
                
            
            
                * {{ "Adresse"|t }}
                
            

            
                * Email
                {{ input('email', 'fromEmail', message.fromEmail ?? '', {
                    id: 'from-email',
                    autocomplete: 'email',
                    class: 'border-2 p-1 w-full',
                    required : true,
                }) }}
                {{ message ? _self.errorList(message.getErrors('fromEmail')) }}
            
            
                * {{ "Telefon"|t }}
                
            

            
                {# I sign up for #}
                {{ entry.signupText|default }}

                {% for row in entry.checkboxOptions %}  
                     {{ row.col1 ? row.col1 }}
                {% endfor %}

                {{ message ? _self.errorList(message.getErrors('message')) }}
            
            
                * {{ entry.messageText }}
                {{ message.message.body ?? '' }}
            
            
        {{ input('hidden', 'subject', "Anmeldung" ?? '', {
            id: 'subject',
        }) }}

        
            {{ "Senden"|t }}
        
    
{% endif %}
{{ entry.formAfterText|default }}
 

Versions
Craft: 4.5.10
Contact-form: 3.0.1
Contact-form extensions: 4.2.2

**Tags:** plugin-contactform
> **Comments:**
> **username_1**: Are you using any caching?  
> **username_0**: Yes, that's it, now it works, thanks so much!  
> **username_1**: Ok cool, I'll add it as an answer so we can close out properly.  

---

## 1 answers

### Answer by username_1 on 2023-11-27. Score: 2 | Accepted answer

If you're using any kind of caching such as Nginx fastCGI static caching/Blitz/Craft's `{% cache %}` tags/Varnish etc, then you'll need to find a way to generate a fresh CSRF token in the hidden CSRF input in each form for each unique site visitor. Typically you'd do this by making a JS fetch request to an uncached template that returns the CSRF token on each page load and then inject the value into all the CSRF inputs. Here's an example from my boilerplate:
<https://github.com/cld-agency/craftwind-boilerplate/blob/craft-4/src/js/main.js#L27>

For the sake of completeness, if you're using Freeform, you'll also need to refresh the form hash as per Solspace's instructions here: <https://docs.solspace.com/craft/freeform/v4/templates/caching/>

> **Comments:**
> **username_2**: The official documentation also has an example of [fetching a fresh CSRF token](https://craftcms.com/docs/4.x/dev/controller-actions.html#ajax).  

---

