<p>We got this sorted before I finished my Stack Exchange question so I figured I'd share if anyone else runs into similar behavior.</p>

<p>After some troubleshooting, we learned that the issue here was that some of our Forms were being cached by Craft's <code>{% cache %}</code> tag and others were not.</p>

<p>CSRF Cookies are unique per user per session, so you don't want to cache them.</p>

<p>In our situation, it wasn't obvious at first that a <code>{% cache %}</code> tag was wrapped around the form, because the <code>{% cache %}</code> tag was actually in a <code>{% block %}</code> in a parent layout file that was being extended.</p>

<p>While searching through the templates helped us track down part of the issue, we also found it helpful to look at what was being cached in the <code>craft_templatecaches</code> table.  In the <code>body</code> column you can see what part of your template code is being cached, and we could see that the form, even though it didn't have <code>{% cache %}</code> tags around it in the template it was in, was being cached within a larger block of code.  </p>

<p>Probably not the most mindblowing thing you will ever read, but it came in handy for me one long hour of one short day in history.</p>

CC BY-SA 3.0
2014-11-01T02:49:25.123Z
Moral of the story... don't cache your CSRF tokens. :)
Brad Bell
CC BY-SA 3.0
2014-11-02T10:29:12.457Z
Sounds like it had the potential of being a very painful issue to track down - glad you found it as soon as you did :)
Andris Sevcenko
CC BY-SA 3.0
2014-11-01T01:11:22.587Z
2014-11-01T01:11:22.587Z
Ben Parizek
<p>We've enabled CSRF Protection on a site.</p>

<p>When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted.</p>

<p>Things we've observed:</p>

<ol>
<li>Some forms work, others don't</li>
<li>Sometimes a browser doesn't place the CSRF cookie</li>
<li>Sometimes two different browsers will have the same CSRF cookie</li>
<li>Sometimes if I delete the CSRF Cookie and then refresh the browser, the cookie won't return</li>
<li>Clearing the Craft cache seems to get forms working again in one browser but not another</li>
</ol>

<p>Why are we seeing this weird behavior?  What is happening?!</p>

<form><security><csrf>
Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?
# Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

(Asked by: username_0 on 2014-11-01)

We've enabled CSRF Protection on a site.

When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted.

Things we've observed:

1. Some forms work, others don't
2. Sometimes a browser doesn't place the CSRF cookie
3. Sometimes two different browsers will have the same CSRF cookie
4. Sometimes if I delete the CSRF Cookie and then refresh the browser, the cookie won't return
5. Clearing the Craft cache seems to get forms working again in one browser but not another

Why are we seeing this weird behavior? What is happening?!

**Tags:** form, security, csrf


---

## 1 answers

### Answer by username_0 on 2014-11-01. Score: 8

We got this sorted before I finished my Stack Exchange question so I figured I'd share if anyone else runs into similar behavior.

After some troubleshooting, we learned that the issue here was that some of our Forms were being cached by Craft's `{% cache %}` tag and others were not.

CSRF Cookies are unique per user per session, so you don't want to cache them.

In our situation, it wasn't obvious at first that a `{% cache %}` tag was wrapped around the form, because the `{% cache %}` tag was actually in a `{% block %}` in a parent layout file that was being extended.

While searching through the templates helped us track down part of the issue, we also found it helpful to look at what was being cached in the `craft_templatecaches` table. In the `body` column you can see what part of your template code is being cached, and we could see that the form, even though it didn't have `{% cache %}` tags around it in the template it was in, was being cached within a larger block of code.

Probably not the most mindblowing thing you will ever read, but it came in handy for me one long hour of one short day in history.

> **Comments:**
> **username_1**: Moral of the story... don't cache your CSRF tokens. :)  
> **username_2**: Sounds like it had the potential of being a very painful issue to track down - glad you found it as soon as you did :)  

---

