<p>From your code sample it looks like you may be using Blitz to cache the page, in which case this is likely neither a Sprig issue nor a Snaptcha issue. A CSRF token is a dynamic token which should not be statically cached. You would normally use the <code>{{ craft.blitz.csrfInput() }}</code> tag but since you are using Sprig, I'd recommend you look into implementing the <a href="https://putyourlightson.com/sprig-cookbook#dynamic-content" rel="nofollow noreferrer">dynamic content example</a> instead of using the <code>craft.blitz</code> tags.</p>
<p>As an aside for future reference, you'll get better support if you can post an issue in the appropriate Github repository along with code samples and the specific version numbers of the plugins in question.</p>

CC BY-SA 4.0
2021-08-22T07:30:08.563Z
Can you mark this as the correct answer, assuming you are satisfied with it, so that this question appears resolved?
Ben Croker
CC BY-SA 4.0
2020-07-31T13:07:37.457Z
2020-07-31T13:07:37.457Z
Ben Croker
<p>We have a site using Sprig and Snaptcha. One of our forms is always returning a 400 error &quot;Unable to verify your data submission&quot; which is usually a CSRF issue but thought Sprig takes care of CSRF?</p>
<p>The only solution seems to be disabled CSRF validation so suppose question is:</p>
<ol>
<li>if we are using Snaptcha on POST form submissions would that be sufficient (eg is CSRF needed), and</li>
<li>any thoughts why sprig might be generating or submitting an incorrect CSRF token?</li>
</ol>
<p>Cheers</p>
<p>Cole</p>

CC BY-SA 4.0
2020-07-30T14:03:12.707Z
Can you share a stripped down version of your component code?
Ben Croker
CC BY-SA 4.0
2020-07-30T14:35:33.597Z
Sure thing Ben > https://gist.github.com/cole007/61985085dbb74e23239b7b6a9bf3a10b
Cole Henley
CC BY-SA 4.0
2020-09-17T08:14:42.667Z
Voted to close this since the question is rather misleading. Feel free to mark it as answered Cole.
Ben Croker
<plugins><csrf><plugin-sprig><plugin-snaptcha>
Sprig/Snaptcha CSRF issue/question
# Sprig/Snaptcha CSRF issue/question

(Asked by: username_0 on 2020-07-30)

We have a site using Sprig and Snaptcha. One of our forms is always returning a 400 error "Unable to verify your data submission" which is usually a CSRF issue but thought Sprig takes care of CSRF?

The only solution seems to be disabled CSRF validation so suppose question is:

1. if we are using Snaptcha on POST form submissions would that be sufficient (eg is CSRF needed), and
2. any thoughts why sprig might be generating or submitting an incorrect CSRF token?

Cheers

Cole

**Tags:** plugins, csrf, plugin-sprig, plugin-snaptcha

> **Comments:**
> **username_1**: Can you share a stripped down version of your component code?  
> **username_0**: Sure thing Ben > https://gist.github.com/cole007/61985085dbb74e23239b7b6a9bf3a10b  
> **username_1**: Voted to close this since the question is rather misleading. Feel free to mark it as answered Cole.  

---

## 1 answers

### Answer by username_1 on 2020-07-31. Score: 2 | Accepted answer

From your code sample it looks like you may be using Blitz to cache the page, in which case this is likely neither a Sprig issue nor a Snaptcha issue. A CSRF token is a dynamic token which should not be statically cached. You would normally use the `{{ craft.blitz.csrfInput() }}` tag but since you are using Sprig, I'd recommend you look into implementing the [dynamic content example](https://putyourlightson.com/sprig-cookbook#dynamic-content) instead of using the `craft.blitz` tags.

As an aside for future reference, you'll get better support if you can post an issue in the appropriate Github repository along with code samples and the specific version numbers of the plugins in question.

> **Comments:**
> **username_1**: Can you mark this as the correct answer, assuming you are satisfied with it, so that this question appears resolved?  

---

