Why do I get Solspace Freeform error: the form has expired?

Question

I am running EE 3.5.15 with Solspace Freeform 5.1.2. Any time I attempt to submit a form I get the following error:

This form has expired. Please refresh and try again.

I have searched extensively for information on this and it always refers to:

<input type="hidden" name="csrf_token" value="602778b7a9b1649d742ca1080e8591c1091b97d5">

This is in place. Is there anything else that could be causing this? I have cleared the cache.

Answer 1

I had an issue recently that had the same symptoms: EE + Freeform and I was always getting the error message, "This form has expired. Please refresh and try again." I was not using any ExpressionEngine caching. I was, however, using AWS Cloudfront and even though I was excluding the pages with my form from being cached by Cloudfront, I was still getting the error.

The issue turned out to be that Cloudfront was not passing through query strings and cookie data that Freeform Next / Freeform Pro was expecting. As such, even though the CSRF token was valid and included in the POST data, other data was missing. I updated my Cloudfront behaviors to pass through all query string and cookie data which can decrease performance, but since I don't want pages with CSRF tokens cached, anyway, is something I am willing to suffer.

If you are using Cloudfront, here are the steps I used that solved my problem:

1. In your Cloudfront distribution, add a new behavior
2. Set the correct path pattern
3. Set "Allowed HTTP Methods" to "GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE" (this ensures that POST data can still be sent)
4. Set "Cache Based on Selected Request Headers" to "All" (this prevent the matching resource from being cached)
5. Set "Forward Cookies" to "All"
6. Set "Query String Forwarding and Caching" to "Forward all, cache based on all"
7. Save the behavior and wait for it to be deployed to the edge caches

Your mileage may vary based on your specific setup, but if you've tried everything else, look and see if you might have a similar issue with query string and/or cookie forwarding.