<p>There isn't really enough information here to give a full answer, but 'Bad Request Unable to verify your data submission' means that Craft is not getting supplied the correct CSRF token.</p>
<p>To confirm, try turning off CSRF protection in your config:
<a href="https://craftcms.com/docs/3.x/config/config-settings.html#enablecsrfprotection" rel="nofollow noreferrer">https://craftcms.com/docs/3.x/config/config-settings.html#enablecsrfprotection</a></p>

CC BY-SA 4.0
2020-09-30T07:18:12.470Z
I don't quite understand what is going on, but I turned off CSRF protection, then changed the cpresources to 774 all is OK. I then removed CSRF protection false from the config and still OK. (So marking your answer correct for that reason!)
Andrew
CC BY-SA 4.0
2020-09-30T06:27:52.093Z
2020-09-30T06:27:52.093Z
Jeremy Daalder
<p>It's an old question, but since I keep coming back and using the answers, I'll add a bit. From time to time it seems after an update I have trouble like this. Fixing the permissions on <code>craft/storage</code> solves it for me.</p>
<pre><code>~/craft$ chmod -R 774 storage
</code></pre>
<p>From the Craft3 <a href="https://craftcms.com/docs/3.x/installation.html#step-2-set-the-file-permissions" rel="nofollow noreferrer">docs</a>:</p>
<p>For Craft to run properly, PHP needs to be able to write to the following places:</p>
<pre><code>.env
composer.json
composer.lock
config/license.key
config/project/*
storage/*
vendor/*
web/cpresources/*
</code></pre>
<p>The exact permissions you should be setting depends on the relationship between the system user that runs PHP and whoever owns the folders and files.</p>
<ul>
<li>If they’re the same user, use 744.</li>
<li>If they’re in the same group, use 774.</li>
<li>If you’re not sure and enjoy life on the edge, use 777.</li>
</ul>

CC BY-SA 4.0
2022-05-14T03:17:48.173Z
2022-05-14T03:17:48.173Z
kr37
<p>In my case i just deleted everything inside the cpresources folder</p>
<p><code>rm -rf ./web/cpresources</code></p>

CC BY-SA 4.0
2023-07-26T10:23:10.947Z
2023-07-26T10:23:10.947Z
Leo Leoncio
<p>Can you please check if CP tries to load resources (js, css) via http:// but the CP itself is loaded via https://?</p>
<p>If that’s the case then you have a mixed content problem, which could be caused by a wrong protocol (http by https) in your site_url setting in .env</p>

CC BY-SA 4.0
2021-12-22T17:17:21.617Z
2021-12-22T17:17:21.617Z
Matthias Redl-Mann
<p>I replaced cpresources from the dev environment with the original backup, and got going again. The reason seemed to be permissions - cpresources worked with 705, but not with 774.</p>

CC BY-SA 4.0
2020-09-30T06:27:36.813Z
2020-09-30T06:27:36.813Z
Andrew
<p>First of all the control panel login is unstyled, and I'm getting Bad Request Unable to verify your data submission when trying to login to the control panel. I can login using a form on the front end, but then I find the CP is still unstyled. Using console I can see the cpresources files cannot be found by the browser - but I've checked they are there, and have file permissions set.</p>
<p>Any ideas???</p>

CC BY-SA 4.0
2021-08-19T00:57:15.637Z
In my case I had a module uploading large files to s3, it got fixed after tweaks on upload_max_filesize, post_max_size and max_execution_time. One can get sidetracked by the CSRF error, but it was actually execution timeout.
Leo Leoncio
<control-panel><login><cp-dashboard>
Bad Request Unable to verify your data submission and unstyled CP
# Bad Request Unable to verify your data submission and unstyled CP

(Asked by: username_0 on 2020-09-29)

First of all the control panel login is unstyled, and I'm getting Bad Request Unable to verify your data submission when trying to login to the control panel. I can login using a form on the front end, but then I find the CP is still unstyled. Using console I can see the cpresources files cannot be found by the browser - but I've checked they are there, and have file permissions set.

Any ideas???

**Tags:** control-panel, login, cp-dashboard

> **Comments:**
> **username_1**: In my case I had a module uploading large files to s3, it got fixed after tweaks on upload_max_filesize, post_max_size and max_execution_time. One can get sidetracked by the CSRF error, but it was actually execution timeout.  

---

## 5 answers

### Answer by username_2 on 2020-09-30. Score: 4 | Accepted answer

There isn't really enough information here to give a full answer, but 'Bad Request Unable to verify your data submission' means that Craft is not getting supplied the correct CSRF token.

To confirm, try turning off CSRF protection in your config:
<https://craftcms.com/docs/3.x/config/config-settings.html#enablecsrfprotection>

> **Comments:**
> **username_0**: I don't quite understand what is going on, but I turned off CSRF protection, then changed the cpresources to 774 all is OK. I then removed CSRF protection false from the config and still OK. (So marking your answer correct for that reason!)  

---

### Answer by username_3 on 2022-05-14. Score: 2

It's an old question, but since I keep coming back and using the answers, I'll add a bit. From time to time it seems after an update I have trouble like this. Fixing the permissions on craft/storage solves it for me.
~/craft$ chmod -R 774 storage

From the Craft3 docs:
For Craft to run properly, PHP needs to be able to write to the following places:
.env
composer.json
composer.lock
config/license.key
config/project/*
storage/*
vendor/*
web/cpresources/*

The exact permissions you should be setting depends on the relationship between the system user that runs PHP and whoever owns the folders and files.

If they’re the same user, use 744.
If they’re in the same group, use 774.
If you’re not sure and enjoy life on the edge, use 777.


---

### Answer by username_1 on 2023-07-26. Score: 1

In my case i just deleted everything inside the cpresources folder

`rm -rf ./web/cpresources`


---

### Answer by username_4 on 2021-12-22. Score: 1

Can you please check if CP tries to load resources (js, css) via http:// but the CP itself is loaded via https://?

If that’s the case then you have a mixed content problem, which could be caused by a wrong protocol (http by https) in your site\_url setting in .env


---

### Answer by username_0 on 2020-09-30. Score: 0

I replaced cpresources from the dev environment with the original backup, and got going again. The reason seemed to be permissions - cpresources worked with 705, but not with 774.


---

