<p>Enable CSRF protection in your config again and add <code>{{ getCsrfInput() }}</code> right after the <code>&lt;form&gt;</code> opening tag on <em>all</em> forms on your site, regardless if they are amforms or mailchimp subscribe.  I can verify that it won't interfere with the mailchimp plugin as I am currently (and just recently) installed it on a project I'm working on and it works fine.</p>

CC BY-SA 3.0
2017-09-27T14:50:10.647Z
Excellent, thank you. I can confirm it's working perfectly.
Sam
CC BY-SA 3.0
2017-09-27T14:43:58.857Z
2017-09-27T14:43:58.857Z
Ryan
<p>I'm using the <a href="https://github.com/aelvan/mailchimp-subscribe-craft" rel="nofollow noreferrer">MailChimp Subscribe for Craft</a> plugin to embed several subscription forms on a website I'm building. </p>

<p>The following code appears via my master <code>_layout.html</code> file:</p>

<pre><code>&lt;form action="" method="POST"&gt;

    &lt;input type="hidden" name="action" value="mailchimpSubscribe/list/Subscribe"&gt;
    &lt;input type="hidden" name="redirect" value="successfully-subscribed"&gt;

    {# MailChimp List ID #}
    &lt;input type="hidden" name="lid" value="XXXXXXXXXX"&gt;

    {% if mailchimpSubscribe is defined %}
        {% if (not mailchimpSubscribe.success) and (mailchimpSubscribe.errorCode!='1000') %}
            &lt;p&gt;An error occured. Please try again.&lt;/p&gt;
        {% endif %}
    {% endif %}

    &lt;div class="field-line"&gt;
        &lt;label&gt;Name&lt;/label&gt;
        &lt;input type="text" placeholder="Name" name="mcvars[NAME]" value="{% if (mailchimpSubscribe is defined) and (not mailchimpSubscribe.success) %}{{ mailchimpSubscribe.values.vars.NAME }}{% endif %}" required&gt;
    &lt;/div&gt;

    &lt;div class="field-line"&gt;
        &lt;label{% if (mailchimpSubscribe is defined) and (mailchimpSubscribe.errorCode=='1000') %} class="error"{% endif %}&gt;Email:&lt;/label&gt;
        &lt;input type="email" placeholder="Email Address" name="email" value="{% if (mailchimpSubscribe is defined) and (not mailchimpSubscribe.success) %}{{ mailchimpSubscribe.values.email }}{% endif %}" required&gt;
    &lt;/div&gt;

    &lt;input type="submit" name="" value="Go!"&gt;

&lt;/form&gt;
</code></pre>

<p>When I hit go, I get the following Bad Request error:</p>

<p><a href="https://i.sstatic.net/NyouD.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/NyouD.jpg" alt="Bad Request"></a></p>

<p>I've temporarily fixed the error via <code>general.php</code> by disabling CSRF Protection (not recommended).</p>

<p>How do I implement CSRF Protection on this form? I've followed <a href="https://craftcms.com/support/csrf-protection" rel="nofollow noreferrer">this article</a>, but replacing the name and value fields will surely disable the plugin's functionality?</p>

<p>Should I also implement the method shown <a href="https://craftcms.com/support/csrf-protection" rel="nofollow noreferrer">here</a> for other forms like <a href="https://github.com/am-impact/amforms" rel="nofollow noreferrer">Am Forms</a>?</p>

<p><strong>Update:</strong>
There's a pull request on the <a href="https://github.com/aelvan/mailchimp-subscribe-craft/pull/43" rel="nofollow noreferrer">plugin git page</a> regarding this.</p>

<form><security><csrf><plugin-amforms><plugin-mailchimpsubscribe>
Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms
# Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

(Asked by: username_0 on 2017-09-27)

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. 
The following code appears via my master _layout.html file:


    
    

    {# MailChimp List ID #}
    

    {% if mailchimpSubscribe is defined %}
        {% if (not mailchimpSubscribe.success) and (mailchimpSubscribe.errorCode!='1000') %}
            An error occured. Please try again.
        {% endif %}
    {% endif %}

    
        Name
        
    

    
        Email:
        
    

    



When I hit go, I get the following Bad Request error:

I've temporarily fixed the error via general.php by disabling CSRF Protection (not recommended).
How do I implement CSRF Protection on this form? I've followed this article, but replacing the name and value fields will surely disable the plugin's functionality?
Should I also implement the method shown here for other forms like Am Forms?
Update:
There's a pull request on the plugin git page regarding this.

**Tags:** form, security, csrf, plugin-amforms, plugin-mailchimpsubscribe


---

## 1 answers

### Answer by username_1 on 2017-09-27. Score: 3 | Accepted answer

Enable CSRF protection in your config again and add `{{ getCsrfInput() }}` right after the  opening tag on *all* forms on your site, regardless if they are amforms or mailchimp subscribe. I can verify that it won't interfere with the mailchimp plugin as I am currently (and just recently) installed it on a project I'm working on and it works fine.

> **Comments:**
> **username_0**: Excellent, thank you. I can confirm it's working perfectly.  

---

