when SOME people try and add their email to the mailing list they get this error:

The following errors were encountered

This form has expired. Please refresh and try again. Return to Previous Page



$config['disable_csrf_protection'] = 'y';

to your config.php and you're done.

| improve this answer | |
  • This disables csrf protection on the entire site for one issue. I wouldn't say this is a solution. – Laurence Cope Sep 23 '14 at 9:28

ExpressionEngine uses an anti CSRF technique where it assigns a value to a hidden field (i believe the field name is csrf_token (XID in version < 2.8.0) and assigns the same value to a session. At form processing stage it compares the two and if they dont match the form returns an error. I believe the error you are getting is the one that gets returned when this happens.

If the visitor is getting this error, the form might be cached at the server / network level, delivering them a stale CSRF token. Are all of the affected users on the same network? Corporate firewalls could be delivering stale pages, for instance.

| improve this answer | |
  • some different users on different networks. It isn't happening to me but is for some. – Peter Eastwood Jun 19 '14 at 22:55
  • I am pretty sure it's what I have described above. I have had the same problem very recently with one of my clients. – Edd Smith Jun 20 '14 at 6:05
  • I do not see a solution in your comment above. What did you do to fix it? – Peter Eastwood Jun 21 '14 at 11:41
  • 1
    There should be a setting in config.php file. Something like 'csfr protection, true' - change it to false. – Edd Smith Jun 21 '14 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.