I've tried just about every fix one can find searching google and these forums for these issues. (FWIW, SSL is being used for the entire site, both on this relevant subdomain and otherwise, working and tests fine.)

$config['cookie_secure'] = 'y';
$config['disable_csrf_protection'] = 'n';

With the above settings, I get the form has expired error.

Error: This form has expired. Please refresh and try again.

Changing the latter config to 'y', the login form page just refreshes with a new session ID in the URL but never logs in, whereas...

$config['cookie_secure'] = 'n';
$config['disable_csrf_protection'] = 'n';

.. enables me to log in just fine. As does:

$config['cp_session_type'] = 's';
$config['cookie_secure'] = 'y';
$config['disable_csrf_protection'] = 'y';

Turning off csrf protection results in the same form expiration error. Below are the relevant config settings I'm currently using from config.php (working login):

$config['cp_session_type'] = 'cs';
$config['cookie_domain'] = '.sub.mydomain.tld'; // is correct
$config['cookie_prefix'] = '';
$config['cookie_path'] = '';
$config['cookie_httponly'] = 'y';
$config['cookie_secure'] = 'n';
$config['disable_csrf_protection'] = 'n';

If it's relevant, ExpressionEngine is running on Apache behind an Nginx proxy, and everything else is functioning appropriately, so far as I can tell. I'm at a loss as to what to do at this point. Since the server is only accessible via https, I don't think there's much issue leaving cookie_secure set to 'n', but if anyone has any idea how to resolve this, I'd appreciate the help.

Thank you very much.

1 Answer 1


Might sound silly, but have you messed with Cache settings at all? Cleared the cache, used a different cache driver, or disabled the cache altogether? I had a similar form issue that was solved by disabling file caching.

  • I've not tried using a different driver or disabling it, but I did clear it many times in the course of my efforts (within EE and without). As it isn't interfering with the function of the site, I've put it aside for now. Thanks for the suggestion, though.
    – Billy M.
    Jan 18, 2019 at 5:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.