i create payment plugin for cartthrob in EE. in this plugin we need to send parameter to gateway website with POST and gateway website will return result with posting parameter to url we gave it. everything goes OK but when gateway send parameter to our url we get error.

This form has expired. Please refresh and try again.

gateway post data to:


when we call that URL without post data its working...

thanks and sorry for my English.

  • Did you fix this? I am getting the same error with SagePay Commented Jun 3, 2014 at 21:28
  • Did anyone find a solution to this. I am having the same issue. Commented Aug 18, 2014 at 16:10

1 Answer 1


EE's "secure forms" feature requires that all POST requests contain a valid XID (or crsf_token in 2.8+). The POST back from your gateway contains no such token, hence the issue.

So you either need to disable secure forms (not recommended), or register an action for your payment plugin, and set crsf_exempt to 1 when you do so. Then use that action URL for your gateway to POST back to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.