I am using EE 2.9 and trying to put together a channel form. However, while it worked initially, now all it gives me each time I test it is the "This form has expired" error. This is the form setup:

{exp:channel:form channel="channel9" return="Links" class="Submit" id="Submit"}
<label for="title">Title</label>
<input type="text" name="title" id="title" value="{title}" size="50" maxlength="100" onkeyup="liveUrlTitle();" />
<label for="{field_name}">{field_label}</label>
{if textarea}
<textarea id="{field_name}" name="{field_name}" dir="{text_direction}" cols="50" rows="{rows}" onclick="setFieldName(this.name)">{field_data}</textarea>
{if textinput}
<input type="text" dir="{text_direction}" id="{field_name}" name="{field_name}" value="{field_data}" maxlength="{maxlength}" size="50" onclick="setFieldName(this.name)" />
<label for="categories">Categories</label>
<select name="category[]" id="categories" size="4">
{if captcha}
<br />
<label for="captcha">Please enter the word you see in the image below:</label>
<br />
<br /><br />
<input type="text" name="captcha" value="{captcha_word}" maxlength="20">
<br />
<input type="submit" name="submit" value="Submit" />

I saw a suggestion about adding <input type="hidden" name="XID" value="{XID_HASH}" /> but this made no difference.


Are you browsing behind a corporate firewall or some other network caching device? It could be errantly delivering you a stale error. I've also seen Chrome be a bit sticky with caches, so try to delete your browser's cache too.

  • Hrm. I am not behind a firewall or anything that caches ... but the site runs Varnish, could that be it? I did try in several browsers and got the error right away each time. – Linda Antonsson Aug 5 '14 at 7:59
  • Yes, Varnish will need to be configured to not cache submission URLs I'd imagine. – Derek Jones Aug 5 '14 at 15:05
  • I've now stripped the submission URLs out of Varnish so it doesn't cache those, but the error is still persisting. – Linda Antonsson Aug 7 '14 at 20:31
  • View source on the form and look for the csrf_token hidden input. Compare that value to your exp_csrf_token cookie. You may also try from another user (logged out in another browser for instance) to see if the values for the token are changing or not. – Derek Jones Aug 7 '14 at 21:12
  • The csrf_token did not match the cookie. Deleting the cookie solved the issue. But is this a one-off fix or will there keep being a discrepancy as soon as a cookie is set? – Linda Antonsson Aug 8 '14 at 8:31

Answered a question regarding this bug a little while ago...

EE 2.8.1 mailing list This form has expired

  • I don't seem to have anything in my config.php related to csfr protection. – Linda Antonsson Aug 7 '14 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.