We are using Channel Form to allow guests to submit contest entries into an EE 2.8.1 site. The form has many fields including an essay field which means it could take some time for someone to complete the form and submit it. During my own tests, I received the EE expired form error message several times when the form had only been open for a few minutes.
How can I go about extending the life of an XID hash to a longer block of time?
1.) Ensure your server time is set correctly and check your ExpressionEngine server timezone setting. Both the form hash ID and the session ID are time sensitive. If ExpressionEngine is calculating when to expire them based on an incorrect time, your hash ID may expire much sooner than it should.
2.) Quickest way to test whether it’s due to Secure Mode is to turn Secure Mode off (in the control panel under Admin ‣ Security and Privacy ‣ Security and Sessions). Leaving Secure Mode off is obviously not recommended. But this allows you to quickly determine if Secure Mode is indeed at issue.
3.) You can also use this command ee()->security->restore_xid(); To restore an expired XID. So you could use a timed request on your end that would restore the xid after its expired, or on submit of the form restore the xid and then submit.
Just thought I'd throw this in there for others that might find this post.
EE 2.8.1 removed the secure form option in the admin section of the CP. The only way to disable now is to add this to your config: $config['disable_csrf_protection'] = 'y';
Just some FYI.
