1

I updated from 2.1.0 to 2.8.1 and afterwards tried to login to the CP, got this error.

"This form has expired. Please refresh and try again."

Made sure there was no folders in the cache but I maybe something is stuck in the db. Not sure and need some help.

Any ideas?

Improve this question
7

Ok so after 5 hours of banging my head on the table and only getting a nasty bump on my forehead I have a fix that was a 1 second fix.

Basically I had to comment out like this //$config['cookie_prefix'] = ''; in config.php

This all started to happen after I moved from a Plesk environment to a Cpanel setup.

Originally I found the follow code from another answer dealing with not being able to login and it worked so I went through and commented out 1 item at a time. Leaving me with the answer and fix, here is that code. I hope it helps save someone else time and aggravation.

$config['cookie_domain'] = ""; $config['cookie_path'] = ""; $config['cookie_prefix'] = ""; $config['admin_session_type'] = "s"; $config['user_session_type'] = "c"; $config['require_ip_for_login'] = "n"; $config['require_ip_for_posting'] = "n"; $config['secure_forms'] = "n";

Improve this answer
3
  • For me, the culprit was the cookie_domain config item, which was set to the live domain in the settings, so locally it borked out. – Low Dec 10 '15 at 14:18
  • Cookie Domain here too. Thanks for saving me the 5 hours. – forrest Dec 18 '18 at 3:26
  • Thank. It is working for me. – bhavin thummar Mar 25 at 7:36
6

I would recommend against editing the config file. Instead, it appears you need to include the following line in any that is posting

<input type="hidden" name="XID" value="{XID_HASH}" />

I had the exact same issue when updating from 2.5.2 to 2.8.1. I added that line and all is good. A few simple AJAX POSTs I converted to GETs to also get around this issue.

I found this solution on this thread: http://ellislab.com/forums/viewthread/237658/

btw, just found more info. Security changed some more in 2.8 v 2.7. So if you want to disable "secure forms" you'll need to use this in config.php instead of what is posted elsewhere.

$config['disable_csrf_protection'] = "y";

More info here: http://ellislab.com/blog/entry/sessions-login-modals-and-secure-forms-in-expressionengine-2.8

Improve this answer
1
  • 1
    I upgraded from 2.7 to 2.8 and had "This form has expired" error. Adding the above <input type="hidden" name="XID" value="{XID_HASH}" /> fixed it for me. I did not need to modify the config setting. Thanks. – Bradley Flood May 30 '14 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.