<p>I have exactly the same issue, clearing cookies worked for me</p>

CC BY-SA 4.0
2018-09-19T13:05:57.177Z
2018-09-19T13:05:57.177Z
swalker
<p>Once the same problem happened for me because of <strong>server caching</strong> and it may happen because of <strong>client-side cookie/cache</strong>. Sometimes, server caching will cache the entire form including CSRF token. So if there any option to use the minimal cache on the server, apply it/remove the server cache option itself. it may fix this problem.</p>
<blockquote>
<p>Note: This only my experience. it may be right/wrong.</p>
</blockquote>

CC BY-SA 4.0
2020-07-14T11:09:40.583Z
2020-07-28T10:27:44.637Z
2020-07-28T10:27:44.637Z
shihab mm
<p>I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my <code>/etc/hosts</code> file on my Mac to point to the IP address for testing. Whilst checking through everything, it seems the site is functioning well, assets have been copied over etc. The only problem is that I am getting an error when trying to log in. </p>

<p>From the front end I get the message: Bad Request: The CSRF token could not be verified.</p>

<pre><code>    2017/07/17 13:52:33 [error] [exception.Craft\HttpException.400] Craft\HttpException: The CSRF token could not be verified. in /home/forge/www.domain.co.uk/craft/app/services/HttpRequestService.php:1337
Stack trace:
#0 /home/forge/www.domain.co.uk/craft/app/framework/base/CComponent.php(561): Craft\HttpRequestService-&gt;validateCsrfToken(Object(CEvent))
#1 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(212): CComponent-&gt;raiseEvent('onbeginrequest', Object(CEvent))
#2 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(183): CApplication-&gt;onBeginRequest(Object(CEvent))
#3 /home/forge/www.domain.co.uk/craft/app/index.php(62): CApplication-&gt;run()
#4 /home/forge/www.domain.co.uk/public/index.php(19): require_once('/home/forge/www...')
#5 {main}
REQUEST_URI=/members/login
HTTP_REFERER=http://www.domain.co.uk/members/login
---
</code></pre>

<p>And from the craft admin login form, this comes up on the console after clicking Login</p>

<p><code>VM43:1 POST http://www.domain.co.uk/index.php?p=admin/actions/users/login 400 (Bad Request)</code></p>

<p>One point to note is that the original website was SSL encrypted but the new server hasn't had an SSL cert installed yet, because DNS is not pointing to it yet. However I have altered the <code>/craft/config/general.php</code> config file to reflect the <code>http://</code> domain.</p>

<p>Any help would be appreciated.
Running latest craft <code>2.6.2987</code></p>

CC BY-SA 3.0
2017-07-17T14:23:31.393Z
It sounds like an old value is cached somewhere/how. If you are unable to log into the CP [Check out this thread](https://craftcms.stackexchange.com/questions/6513/manually-clean-database-cache) to manually clear the db cache to see if you can log in.
Damon
CC BY-SA 3.0
2017-07-17T14:27:12.537Z
I cleared the three tables `craft_templatecachecriteria`, `craft_templatecacheelements` & `craft_temlpatecaches` however I still get the same issue.
Adam Menczykowski
CC BY-SA 3.0
2017-07-17T14:28:00.347Z
I also checked to see if any of the login form code is within `{% cache %}` tags but it is not.
Adam Menczykowski
CC BY-SA 3.0
2017-07-17T16:57:56.090Z
Try clearing your browser's cookies. If that doesn't work, what are the domains for Craft's cookies being set to?
Brad Bell
CC BY-SA 3.0
2017-08-16T12:51:02.710Z
@BradBell How do we check the domains for Craft's cookies being to sent? (apologies, front end stuff is not my strong stuff)
isral
CC BY-SA 3.0
2017-08-16T20:18:49.307Z
If you're using Chrome, it'll be under the inspector's Application table, then Cookies on the left.  Domain will be a column in the right hand pane.
Brad Bell
CC BY-SA 3.0
2017-08-17T20:34:00.440Z
I ran into this when I logged in via http then tried to switch to https. It's like it caches the csrf token, but not the session variable.
ponies
CC BY-SA 3.0
2018-02-28T00:58:48.183Z
@ponies many thanks, I ran into a similar issue today. Clearing cookies did the trick.
erwinheiser
<login><server><csrf><https>
Login - Bad Request: The CSRF token could not be verified
# Login - Bad Request: The CSRF token could not be verified

(Asked by: username_0 on 2017-07-17)

I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my /etc/hosts file on my Mac to point to the IP address for testing. Whilst checking through everything, it seems the site is functioning well, assets have been copied over etc. The only problem is that I am getting an error when trying to log in. 
From the front end I get the message: Bad Request: The CSRF token could not be verified.
    2017/07/17 13:52:33 [error] [exception.Craft\HttpException.400] Craft\HttpException: The CSRF token could not be verified. in /home/forge/www.domain.co.uk/craft/app/services/HttpRequestService.php:1337
Stack trace:
#0 /home/forge/www.domain.co.uk/craft/app/framework/base/CComponent.php(561): Craft\HttpRequestService->validateCsrfToken(Object(CEvent))
#1 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(212): CComponent->raiseEvent('onbeginrequest', Object(CEvent))
#2 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(183): CApplication->onBeginRequest(Object(CEvent))
#3 /home/forge/www.domain.co.uk/craft/app/index.php(62): CApplication->run()
#4 /home/forge/www.domain.co.uk/public/index.php(19): require_once('/home/forge/www...')
#5 {main}
REQUEST_URI=/members/login
HTTP_REFERER=http://www.domain.co.uk/members/login
---

And from the craft admin login form, this comes up on the console after clicking Login
VM43:1 POST http://www.domain.co.uk/index.php?p=admin/actions/users/login 400 (Bad Request)
One point to note is that the original website was SSL encrypted but the new server hasn't had an SSL cert installed yet, because DNS is not pointing to it yet. However I have altered the /craft/config/general.php config file to reflect the http:// domain.
Any help would be appreciated.
Running latest craft 2.6.2987

**Tags:** login, server, csrf, https

> **Comments:**
> **username_1**: It sounds like an old value is cached somewhere/how. If you are unable to log into the CP [Check out this thread](https://craftcms.stackexchange.com/questions/6513/manually-clean-database-cache) to manually clear the db cache to see if you can log in.  
> **username_0**: I cleared the three tables `craft_templatecachecriteria`, `craft_templatecacheelements` & `craft_temlpatecaches` however I still get the same issue.  
> **username_0**: I also checked to see if any of the login form code is within `{% cache %}` tags but it is not.  
> **username_2**: Try clearing your browser's cookies. If that doesn't work, what are the domains for Craft's cookies being set to?  
> **username_3**: @BradBell How do we check the domains for Craft's cookies being to sent? (apologies, front end stuff is not my strong stuff)  
> **username_2**: If you're using Chrome, it'll be under the inspector's Application table, then Cookies on the left.  Domain will be a column in the right hand pane.  
> **username_4**: I ran into this when I logged in via http then tried to switch to https. It's like it caches the csrf token, but not the session variable.  
> **username_5**: @username_4 many thanks, I ran into a similar issue today. Clearing cookies did the trick.  

---

## 2 answers

### Answer by username_6 on 2018-09-19. Score: 2

I have exactly the same issue, clearing cookies worked for me


---

### Answer by username_7 on 2020-07-14. Score: 2

Once the same problem happened for me because of **server caching** and it may happen because of **client-side cookie/cache**. Sometimes, server caching will cache the entire form including CSRF token. So if there any option to use the minimal cache on the server, apply it/remove the server cache option itself. it may fix this problem.

> Note: This only my experience. it may be right/wrong.


---

