Several users are complaining about this error whenever they try to submit one of our online forms: "invalid form id(s) submitted".
The problem is I can't replicate this error. Also, many people have submitted the same for without any problems.
I found this link http://www.solspace.com/forums/viewthread/13745/#55777 which suggests it's to do with XID hash. If so, how can I set it so it doesn't expire.
Am using EE v2.4.0 FreeForm Pro 4.0.7.
Abdi
The only way to prevent forms which use EE's form hashing security is to disable secure forms altogether. Some modules have a setting to disable it per-form, but it appears that Freeform does not.
Most often this error comes up when people use their "back" button and the page is loaded from the cache, not reloaded from the server.
I would first suggest upgrading the the most recent version, 4.0.10 (as of the time of this writing.)
Some possible things happening:
Are you using .htaccess to remove or add www. to your website? If so, make sure whichever one you are redirecting to is set that way in your config file. Freeform uses EE's built in functions to build the submission URLS which in turn uses the config file's set base url. Thus, if you are redirecting with .htaccess to www, but your config is not set to www.site.com/index.php or whatever, every single link built with EE is without www. and is redirecting. This means any POST variables are lost due to the redirect.
Are they loading the page and waiting multiple hours to submit it? Secure forms has a 3 hour timeout.
I had the same problem and the cause was that template caching was turned on. Everything worked fine once it was disabled.
I've had reports of this error, too. The problem ended up being the time it takes to complete the form. Is this a form that would take your user a while to complete?
It's not just the CSRF token (previously called XID hash), which needs to be refreshed, it's also the hidden field called params_id. That field links up with the form parameters in exp_freeform_params, and only lasts 24 hours. So if you're doing any caching (such as full page or fragment caching with Stash or CE Cache), you'll need to find a way to refresh both those things. Personally I find it convenient to use full page caching and then reload Freeform forms dynamically via Ajax. Naturally, this creates an unfortunate JS dependency for completing the form... but actually that dependency can help to reduce spam, so swings and roundabouts...
Stash has the stash:nocache tag pairs which can help in escaping parts of cache fragments, which is sometimes a better solution, but that can get extremely complicated when nested caches and embedded templates are involved.
