1

Running 2.7.3 with secure forms, everything works fine passing the xid_hash etc... until somebody clicks the back button or tries to reload after submitting a form.

It's the usual issue of it trying to reuse the same xid, but I can't refresh the xid as they're just clicking back.

I notice in the 2.8 changelog developers section it's deprecated a load of xid functions, do we know if this somehow fixes this?

Improve this question
3
  • I haven't tested anything, but look at the following questions:stackoverflow.com/questions/829046/… and expressionengine.stackexchange.com/questions/14490/…. Use javascript to detect if the page is stale, and then make an AJAX call to refresh the XID field.
    – nageeb
    Mar 21, 2014 at 12:50
  • @nageeb Thanks for the links - I'd seen one but not the other. I can't really see this as a solution though. There are a high percentage of users that rely on the back button (see here) it seems ridiculous that EE would add in a feature that essentially breaks it on any number of interactions. We shouldn't have to rely on js to work around it.
    – Jammooka
    Mar 24, 2014 at 10:22
  • Agreed. I've always found EE's XID feature to cause more headaches than the problem it was designed to 'solve'.
    – nageeb
    Mar 24, 2014 at 15:25

1 Answer 1

Reset to default
1

We have an add-on for this that is very simple to use and will allow you to put a plugin tag under your form {exp:formrefresher} and if that template is loaded via the back button it will refresh the page, and will refresh your form with a new XID to remove the users frustration on repeated form submissions with errors do to expired XID.

Form Refresher -> https://devot-ee.com/add-ons/form-refresher

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.