Solspace freeform "form expired" under EE 2.8

Question

I'm having problems with a freeform form since upgrading to EE2.8. It keeps giving the following error on submit

This form has expired. Please refresh and try again.

Template caching is off.

Running freeform 4.1.3

{exp:freeform:form
    form_name="contact_form"
    return="contact_us/thank_you
}
<h3>Name:</h3><p><input type="text" name="name" /></p>
<h3>Email:</h3><p><input type="text" name="email" /></p>
<h3>Questions or Comments:</h3><p><textarea name="comment" rows="6" ></textarea></p>
<p><input type="submit" name="submit" value="Send It" class="button" /></p>
{/exp:freeform:form} 

Answer 1

This issue involves the changed security module within EE. Solspace are working on the proper solution however I have also advised them on how to fix this issue (in a different module, facebook connect).

To help them and the community, try this:

1. Identify the action used to submit the freeform (refer to the exp_actions) table.
2. Modify the action in exp_actions, and set the csrf_exempt column to 1 (true)

Try to submit your freeform, if it works then this is indeed the security model issue.

The above fix will work for you however it should be noted that this removes the freeform submission from the standard cross site scripting checks. You are relying on SolSpace's module to validate the submission.

As always, for production purposes I recommend you wait for SolSpace's official patch, but if the above method helps, please let SolSpace (and us) know!!

Answer 2

Freeform 4.1.3 is not compatible with EE 2.8. Solspace are working on an update.

Adjusting csft_exempt to 1 in the exp_actions table (Freeform - save_form ) got rid of the error so it looks like this has been caused by the security model issue.

Answer 3

I received the form expired error message using Freeform 4.2.2 and EE 2.9.2. I added this to config.php:

$config['disable_csrf_protection'] = "y";

The form submitted, but I really didn't want to leave that setting there. I did a little more digging and found that I needed to add a CSRF Token to my form. So I added this hidden input within my freeform tags:

<input type="hidden" name="csrf_token" value="{csrf_token}">

I was then able to delete the config change above and the form submitted successfully.