<p>I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with.</p>

<p>I've read <a href="https://craftcms.com/support/csrf-protection#updating-your-javascript" rel="nofollow noreferrer">the docs on CSRF protection</a> and specifically implemented what it says for jQuery based post submissions. However I'm still getting a 400 error saying "<strong>Bad Request - The CSRF token could not be verified.</strong>" for every post request. </p>

<p><a href="https://i.sstatic.net/GkDXm.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/GkDXm.jpg" alt="CSRF &amp; 400 error"></a></p>

<p>You can see a token is being sent in the post data.</p>

CC BY-SA 3.0
2016-11-29T21:33:51.310Z
Does this solve the problem? http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes
Lindsey D
CC BY-SA 3.0
2016-11-29T21:57:53.537Z
Hi Lindsey. Thanks for the link but no that's what I'm already doing (hence linking to that in the docs and showing the token is in the post data being send to the plugin action).
JamesNZ
CC BY-SA 3.0
2016-11-30T00:32:58.273Z
Is there any caching involved here?  My guess would be you're sending a token, but it's an old token....
Jeremy Daalder
CC BY-SA 3.0
2016-11-30T01:37:41.490Z
Hey Jeremy. No caching at this point. The token is generated on page load, then is used whenever the user interacts with the filters (meaning multiple submissions). I'm not sure if that is an issue? It doesn't work on the first one either though.
JamesNZ
CC BY-SA 3.0
2016-11-30T02:23:19.707Z
Hmm, no - I just double checked but two add to carts in a row can use the same token (it's tied to the session I guess).  I am pretty sure I have seen CSRF being raised as an issue when the error was something else.  I presume you've turned off CSRF and made sure all is working without it?
Jeremy Daalder
CC BY-SA 3.0
2017-05-08T17:59:07.927Z
I'm having this same problem right now, ever figure out the issue?
Rick Kukiela
CC BY-SA 3.0
2017-05-09T04:18:51.503Z
Sorry Rick. I have since got past the issue but am unsure what happened. I'm trying to replicate this again for you.
JamesNZ
CC BY-SA 3.0
2017-05-09T04:24:40.437Z
Hey Rick - I can't see anything relevant that changed from a code point of view since this date. Perhaps in shifting databases between environments messed it up for me. Try clearing your compiled templates (or probably all your caches) and let us know if that helps.
JamesNZ
<plugin-development><ajax><csrf>
CSRF token could not be verified - ajax
# CSRF token could not be verified - ajax

(Asked by: username_0 on 2016-11-29)

I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with.

I've read [the docs on CSRF protection](https://craftcms.com/support/csrf-protection#updating-your-javascript) and specifically implemented what it says for jQuery based post submissions. However I'm still getting a 400 error saying "**Bad Request - The CSRF token could not be verified.**" for every post request.

[![CSRF & 400 error](https://i.sstatic.net/GkDXm.jpg)](https://i.sstatic.net/GkDXm.jpg)

You can see a token is being sent in the post data.

**Tags:** plugin-development, ajax, csrf

> **Comments:**
> **username_1**: Does this solve the problem? http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes  
> **username_0**: Hi Lindsey. Thanks for the link but no that's what I'm already doing (hence linking to that in the docs and showing the token is in the post data being send to the plugin action).  
> **username_2**: Is there any caching involved here?  My guess would be you're sending a token, but it's an old token....  
> **username_0**: Hey Jeremy. No caching at this point. The token is generated on page load, then is used whenever the user interacts with the filters (meaning multiple submissions). I'm not sure if that is an issue? It doesn't work on the first one either though.  
> **username_2**: Hmm, no - I just double checked but two add to carts in a row can use the same token (it's tied to the session I guess).  I am pretty sure I have seen CSRF being raised as an issue when the error was something else.  I presume you've turned off CSRF and made sure all is working without it?  
> **username_3**: I'm having this same problem right now, ever figure out the issue?  
> **username_0**: Sorry Rick. I have since got past the issue but am unsure what happened. I'm trying to replicate this again for you.  
> **username_0**: Hey Rick - I can't see anything relevant that changed from a code point of view since this date. Perhaps in shifting databases between environments messed it up for me. Try clearing your compiled templates (or probably all your caches) and let us know if that helps.  

---

## 0 answers

