I have this simple Facebook iframe App

The secure URL that is called is: https://www.das-boot.com/facebook

But in facebook nothing is shown - only the following Expression Engine Error is thrown: "This form has expired. Please refresh and try again."

BUT there isn't any form or any other ee-tags within the called ee-template only plain html code!?

Anyone any idea? Going crazy with this...

  • Wow, this is a doozy of a question! it seems that when facebook requests a page into its iframe it comes in via a facebook page fetcher. It is this 'fetch' is a post style fetch (I believe facebook posts FB Auth info). therefor you'll need to look at (a) passing an csrf_toekn to facebook for passing back in its digest or (b) getting around the csrf_token check in EE. I'm sure someone with more EE/Facebook experiance will chime in with a proper answer before long!
    – Blatant
    Jun 10, 2015 at 14:00
  • Thanks for answering. I think I get an idea of what might be wrong - but still I really don't know how to solve anything :( Where to start from? Absolutely no idea...
    – amadeus
    Jun 16, 2015 at 5:47
  • Here's an idea, throw together a quick extension, Catch the Session Hooks, here you might be able to handle the Facebook post, perhpas check the digest and pop the FB details in the session, then clear the Post array. no post, no problem. The only thing is to find a hook before the security library loads so we can effect the post prior to it throwing a security wobbly. Other ideas are work out how to make FB pass an csrf_token value or header.
    – Blatant
    Jun 16, 2015 at 8:57

1 Answer 1


For forms add a <input type="hidden" name="csrf_token" value="{csrf_token}"> or disable it in config.php

$config['disable_csrf_protection'] = 'y';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.