We've setup a site for a client to populate with their content and they are having a recurring issue when they go to 'save revision' or 'submit' the entry.

If they've spent a bit of time adding the entry content, when they click either save or submit, they're getting dumped out to the control panel home.

I wondered whether the session could have been expiring (or changing somehow) so changed the security to cookies only, but they're still having the issue.

Anyone else come across this or have any thoughts as to why it might be happening?


3 Answers 3


ExpressionEngine natively processes forms in secure mode which means each for submission is tied to an automatically generated XID / Hash which is passed as a hidden field in all CP and most front-end forms.

The XID is a hash containing a reference to a database entry which gives EE a bunch of info about the user (their user agent, timestamp created, ip address and some other identifying 'stuff').

The XID is validated on submission (to ensure the same user visiting the form is the same user submitting the form) so if the XID fails to validate, or expires - EE will block the submission and in the case of a user being in the CP, it simply redirects them to the home page which isn't very helpful.

To prevent your issue, you can disable secure form processing globally via:

Admin -> Security and Session Preferences -> Process form data in Secure Mode? -> No

I'm always quite wary of disabling this though, if you do - proceed with caution. You're opening a few holes and it's up to you to determine if the risk is worth it.

EDIT: I should also mention that a common cause of what you are describing is a user submitting a form and using their browser's back button to submit again. Because the XID has been used, it is no longer 'valid' and EE will reject it.

  • Yeah I wondered about this, but can't see any reason why the XID on submit wouldn't be valid. I've updated to 2.7.2 hoping that the update on the XID might resolve the issue so we'll wait and see how they get on. I'll update the thread with any news... Commented Oct 22, 2013 at 10:31
  • So the upgrade to 2.7.2 doesn't seem to have made a difference. Switching secure forms off does seem to have resolved the issue though, but no idea why it should work intermittently with secure forms on. \:-/ Commented Oct 25, 2013 at 9:17
  • @AndrewArmitage I suppose it’s intermittent because sometimes the XID expires (as Iain Urquhart mentioned) when the user takes a little longer. I’ve been having this same issue while developing a client site and can confirm that following the above instructions resolve this issue. If it resolved the issue for you, please mark this answer as accepted.
    – Alfonso
    Commented Oct 29, 2013 at 14:58

Oddly enough, the only known solution to this that I've been able to use is to use the back button, and save again. It works more often than it doesn't.

This is what made me think that the issue was not the XID at all.

Also, none of the content being submitted differs greatly from a successful submit to a failed one. New entries v edits, paragraphs v images, everything appears to be fair game for this random occurrence.

On the front end, an invalid XID results in "You are not authorized to perform this action." This results in no obvious error. Anyone who did not expect a View Entry screen would think that their entry had saved just fine.

As someone still experiencing this issue, my client cannot turn off Secure Mode because the site relies heavily on user-generated content.

This is a bug, and it needs to be handled as such.

  • We've got the same problem, only work around was : $config['disable_csrf_protection'] = 'y'; which I really do not want to post to a live site.
    – paulcripps
    Commented Apr 25, 2015 at 21:44

I've experienced these same symptoms with clients running a site on multiple servers behind a load balancer. When this is the case, you may need to whitelist the proxy IPs.

You can do this in /system/expressionengine/config/config.php in the Reverse Proxy IPs section.

| Reverse Proxy IPs
| If your server is behind a reverse proxy, you must whitelist the proxy IP
| addresses from which CodeIgniter should trust the HTTP_X_FORWARDED_FOR
| header in order to properly identify the visitor's IP address.
| Comma-delimited, e.g. ','
$config['proxy_ips'] = "";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.