# CSRF token error. Try to refresh the page and try again

**URL:** <https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839>\
**Category:** Product Support\
**Created:** [November 3, 2020, 10:42am UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839 "2020-11-03T10:42:06Z")\
**Posts on this page:** 19\
**Page:** 2

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [January 20, 2022, 12:59pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/21 "2022-01-20T12:59:50Z")

</div>

@mikew did you apply the ugly-but-works workaround with the cookie lifetime?

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [January 20, 2022, 2:01pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/22 "2022-01-20T14:01:37Z")

</div>

Another ugly fix for Mautic 3 instance is to replace the template Views:User:Security:ajax.html.php template

I encountered this error if the user has been logged out and I logged back in using ajax render login form.

I solved it by forcing complete refresh of login page which also regenerates the CSRF token:

```auto
<?php
$view->extend('MauticCoreBundle:Default:content.html.php');
$view['slots']->set('headerTitle', $view['translator']->trans('mautic.user.auth.expired.header'));
?>

<script type="text/javascript">
    window.location.reload();
</script>

```

Hope it helps someone.  
Regards, M.

---

<div class="post-metadata">

**Author:** ![elsaadj](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/elsaadj/32/672_2.png) [@elsaadj](https://forum.mautic.org/u/elsaadj)\
**Post date:** [March 23, 2022, 12:15pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/23 "2022-03-23T12:15:01Z")

</div>

Using latest 4.2.0 and still getting this issue.

Click new contact, fill the form with details, click save, and it tells CSRF token error, now you have to re-enter all the contact information again after refresh. Why it does not tell you the CSRF token error when clicking on add contact or doing refresh before entering info?

What is the fix for this?

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [March 23, 2022, 1:39pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/24 "2022-03-23T13:39:16Z")

</div>

I have solved this here:

> [@CSRF token error. Try to refresh the page and try again](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/22):
>
> Another ugly fix for Mautic 3 instance is to replace the template Views:User:Security:ajax.html.php template I encountered this error if the user has been logged out and I logged back in using ajax render login form. I solved it by forcing complete refresh of login page which also regenerates the CSRF token: \<?php $view-\>extend('MauticCoreBundle:Default:content.html.php'); $view['slots']-\>set('headerTitle', $view['translator']-\>trans('mautic.user.auth.expired.header')); ?\> \<script type="tex…

Its not my favorite fix, but its the only one that worked so far.

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [March 23, 2022, 2:11pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/25 "2022-03-23T14:11:07Z")

</div>

There is a PR coming up, that plays with the ‘Remember me’ cookie.  
Plz test if you can, it’s keeping me logged in:

> <https://github.com/mautic/mautic/pull/10994>
>
> \<!-- ## Which branch should I use for my PR?
> 
> Assuming that:
> 
> a = current ma…jor release
> b = current minor release
> c = future major release
> 
> \* a.x for any features and enhancements (e.g. 4.x)
> \* a.b for any bug fixes (e.g. 4.0, 4.1, 4.2)
> \* c.x for any features, enhancements or bug fixes with backward compatibility breaking changes (e.g. 5.x) --\>
> 
> | Q | A
> | -------------------------------------- | ---
> | Bug fix? (use the a.b branch) | \[X \]
> | New feature/enhancement? (use the a.x branch) | \[\]
> | Deprecations? | \[\]
> | BC breaks? (use the c.x branch) | \[\]
> | Automated tests included? | \[\] 
> | Related user documentation PR URL | mautic/mautic-documentation#... 
> | Related developer documentation PR URL | mautic/developer-documentation#... 
> | Issue(s) addressed | Fixes #... 
> 
> \<!--
> Additionally (see https://contribute.mautic.org/contributing-to-mautic/developer/code/pull-requests#work-on-your-pull-request):
> - Always add tests and ensure they pass.
> - Bug fixes must be submitted against the lowest maintained branch where they apply
> (lowest branches are regularly merged to upper ones so they get the fixes too.)
> - Features and deprecations must be submitted against the "4.x" branch.
> \--\>
> 
> \#### Description:
> 
> When people log in, there is an option to "keep me logged in". This used to add a cookie to the browner named REMEMBERME, but this behavior broke somewhere down the line. Now people are getting logged out soon and having to log back in, often losing work.
> 
> Look at \[this issue\](https://github.com/mautic/mautic/issues/9804#issuecomment-1025756557) and \[this issue\](https://github.com/mautic/mautic/issues/9011#issuecomment-1009051271) for reference.
> 
> \#### Steps to test this PR:
> 
> 1. Open this PR on Gitpod or pull down for testing locally (see docs on testing PRs \[here\](https://contribute.mautic.org/contributing-to-mautic/tester))
> 2. Before logging in, open the cookie viewer. You can do this by right click -\> Inspect -\> and go to Application. Scroll down to Storage -\> Cookies and there you can see browser cookies
> 3. Log in and click "keep me logged in". You should see a cookie named REMEMBERME added to the browser cookies
> 4. Delete all cookies except the REMEMBERME cookie (click on the cookie, then Backspace). Reload the page. You should still be logged in
> 5. Delete all cookies (including REMEMBERME) and reload the page. You should be logged out
> 
> 
> \<a href="https://gitpod.io/#https://github.com/mautic/mautic/pull/10994"\>\<img src="https://gitpod.io/button/open-in-gitpod.svg"/\>\</a\>

---

<div class="post-metadata">

**Author:** ![mikew](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mikew/32/5156_2.png) [@mikew](https://forum.mautic.org/u/mikew)\
**Post date:** [March 23, 2022, 4:30pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/26 "2022-03-23T16:30:53Z")

</div>

Hey @joeyk I tried this and seems to have not worked for me.  
I updated the issue on GitHub, I am not able to get to the mautic instance “offline error”. I see some errors in my log:

```auto
[error] 1851#1851: *784641 FastCGI sent in stderr: "PHP message: ParseError: syntax error, unexpected ''lifetime'' (T_CONSTANT_ENCAPSED_STRING), expecting ']' - in file /var/www/mautic/app/config/security.php - at line 98" while reading response header from upstream, client: 132.82.126.64, server: mymautic.com, request: "POST /mailer/sendgrid_api/callback HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.4-fpm.sock:", host: "mymautic.com"

```

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [March 23, 2022, 6:28pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/27 "2022-03-23T18:28:33Z")

</div>

It would be interesting to know whats the value of:  
`$configParameterBag->get('rememberme_lifetime')`

Looking at my config its nothing out of the ordinary and it should not break. Can you clear the cache and try again.

---

<div class="post-metadata">

**Author:** ![mikew](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mikew/32/5156_2.png) [@mikew](https://forum.mautic.org/u/mikew)\
**Post date:** [March 23, 2022, 6:44pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/28 "2022-03-23T18:44:52Z")

</div>

did that a few times… strange behaviour.

---

<div class="post-metadata">

**Author:** ![bradycargle](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/bradycargle/32/6252_2.png) [@bradycargle](https://forum.mautic.org/u/bradycargle)\
**Post date:** [March 25, 2022, 1:22pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/29 "2022-03-25T13:22:53Z")

</div>

@mzagmajster You can check the value of $configParameterBag-\>get(‘rememberme\_lifetime’) by putting the line: `dd($configParameterBag);` right after your `configParameterBag = $parameterLoader->getParameterBag();`. The value should be 31536000, which is one year in seconds

@mikew Copying a reply I made on GitHub here:

Might be a few ways to fix this. It sounds like the file might have been copied to the wrong directory; can you make sure the change is only in app/config/security.php?

If that’s not the problem, let’s try this: Revert back to your Mautic instance from before the change, then open your console, cd to the Mautic folder, and type “gh pr checkout 10994”. This will make the exact file changes that’s in my PR. See if that works for you

Last, we can always test with GitPod. You can click on the “Open in GitPod” button in GitHub when you look at the PR. It’s working for me there. I found the cookie using Right Click \> Inspect \> Application \> Cookies \> [https://8080-bradycargle](https://8080-bradycargle/)…

---

<div class="post-metadata">

**Author:** ![richmarks20](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/richmarks20/32/7266_2.png) [@richmarks20](https://forum.mautic.org/u/richmarks20)\
**Post date:** [February 2, 2023, 2:38pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/30 "2023-02-02T14:38:31Z")

</div>

Just to reup this, it’s still happening to me on 4.4.5 - frequency vastly reduced, so something has been changed in the last few releases, but still happening, particularly when adding contacts, although I can’t put my finger on any particular action that causes it. Anyone working on it, let me know if I can provide any helpful information…

---

<div class="post-metadata">

**Author:** ![ankushanand](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ankushanand/32/8565_2.png) [@ankushanand](https://forum.mautic.org/u/ankushanand)\
**Post date:** [March 3, 2023, 8:41am UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/31 "2023-03-03T08:41:23Z")

</div>

I am also facing this issue in some of my mautic installations

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [March 3, 2023, 6:00pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/32 "2023-03-03T18:00:17Z")

</div>

It’s normal. Just log in again from the REAL login page.

---

<div class="post-metadata">

**Author:** ![ankushanand](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ankushanand/32/8565_2.png) [@ankushanand](https://forum.mautic.org/u/ankushanand)\
**Post date:** [March 4, 2023, 5:15am UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/33 "2023-03-04T05:15:11Z")

</div>

Yeah, I do that all the time, Login Again but sometimes its frustrating when I have made changes and then it gives this error.

---

<div class="post-metadata">

**Author:** ![diegoom](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/diegoom/32/9771_2.png) [@diegoom](https://forum.mautic.org/u/diegoom)\
**Post date:** [May 9, 2023, 12:28pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/34 "2023-05-09T12:28:06Z")

</div>

This happens to me a lot too.  
The truth is a bit strange.

---

<div class="post-metadata">

**Author:** ![Yosu\_Cadilla](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/yosu_cadilla/32/6206_2.png) [@Yosu\_Cadilla](https://forum.mautic.org/u/Yosu_Cadilla)\
**Post date:** [May 9, 2023, 12:32pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/35 "2023-05-09T12:32:48Z")

</div>

Oldest problem in the Mautic pile!

I remember @escopecz giving an explanation many years ago, I also remember not understanding anything he said at the time…  
What I do remember from his explanation of the issue is that it wasn’t Mautic’s fault…

---

<div class="post-metadata">

**Author:** ![mikew](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mikew/32/5156_2.png) [@mikew](https://forum.mautic.org/u/mikew)\
**Post date:** [May 9, 2023, 12:55pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/36 "2023-05-09T12:55:09Z")

</div>

I actually once got this fixed by upgrading nginx to the latest version… but downgraded after that and back to the same problem. I remember that Mautic was not playing well with php 8.0 and the latest nginx version

---

<div class="post-metadata">

**Author:** ![richmarks20](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/richmarks20/32/7266_2.png) [@richmarks20](https://forum.mautic.org/u/richmarks20)\
**Post date:** [September 6, 2023, 1:38pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/37 "2023-09-06T13:38:06Z")

</div>

It seems to me that this might have some (positive) impact on the issue

> <https://github.com/mautic/mautic/pull/12042>
>
> \<!-- ## Which branch should I use for my PR?
> 
> Assuming that:
> 
> a = current ma…jor release
> b = current minor release
> c = future major release
> 
> \* a.x for any features and enhancements (e.g. 5.x)
> \* a.b for any bug fixes (e.g. 4.4, 5.1)
> \* c.x for any features, enhancements or bug fixes with backward compatibility breaking changes (e.g. 5.x) --\>
> 
> | Q | A
> | -------------------------------------- | ---
> | Bug fix? (use the a.b branch) | \[x\]
> | New feature/enhancement? (use the a.x branch) | \[\]
> | Deprecations? | \[\]
> | BC breaks? (use the c.x branch) | \[\]
> | Automated tests included? | \[\] 
> | Related user documentation PR URL | mautic/mautic-documentation#... 
> | Related developer documentation PR URL | mautic/developer-documentation#... 
> | Issue(s) addressed | Fixes #... 
> 
> \<!--
> Additionally (see https://contribute.mautic.org/contributing-to-mautic/developer/code/pull-requests#work-on-your-pull-request):
> - Always add tests and ensure they pass.
> - Bug fixes must be submitted against the lowest maintained branch where they apply
> (lowest branches are regularly merged to upper ones so they get the fixes too.)
> - Features and deprecations must be submitted against the "4.x" branch.
> \--\>
> 
> \#### Description:
> 
> \<!--
> Please write a short README for your feature/bugfix. This will help people understand your PR and what it aims to do. If you are fixing a bug and if there is no linked issue already, please provide steps to reproduce the issue here.
> \--\>
> 
> Backport for PR: https://github.com/mautic/mautic/pull/12037
>  
> When a Mautic instance is setup with 2 domains, one publicly accessible and one not (e.g. internal.mautic.com and public.mautic.com), and the site\_url is set to the public mautic (so emails add the correct URls, images, etc) then AJAX requests when browsing the internal site will incorrectly use the public URL.
> 
> Specifically: 
> \- Campaign detail view fetches contacts using a JS request, which will use the wrong URL
> \- Segment detail view fetches contacts using a JS request, which will use the wrong URL
> 
> This PR simply replaces the absolute URL in the data-target-url with the path, so the JS automatically uses the current domain regardless of which one it is.
> 
> \#### Steps to test this PR:
> 
> \<!--
> This part is really important. If you want your PR to be merged, take the time to write very clear, annotated and step by step test instructions. Do not assume any previous knowledge - testers may not be developers.
> \--\>
> 1. Open this PR on Gitpod or pull down for testing locally (see docs on testing PRs \[here\](https://contribute.mautic.org/contributing-to-mautic/tester))
> 2. Set the site URL to a subdomain
> 3. Clear caches
> 4. Create a campaign and some contacts that will be added to the campaign
> 5. Visit the campaign detail page
> 6. Check the network tab, the request to fetch contacts should NOT use the subdomain site URL (without this patch, it would use the site url)
> 7. Then do the same for segments.
> 
> \<!--
> If you have any deprecations, list them here along with the new alternative.
> If you have any backwards compatibility breaks, list them here.
> \--\>

In some cases, if AJAX requests are made by the page to an apparently different (perhaps local as opposed to public) location, that may well cause CSRF issues.

This is merged into Mautic 4.4.10 👍

> **[Release Mautic Community 4.4.10 · mautic/mautic](https://github.com/mautic/mautic/releases/tag/4.4.10)**
>
> What's Changed
> 🐛 Bugs
> 
> AJAX requests use the site\_url instead of the current domain \[backport\] by @nick-vanpraet in #12042
> ensure the elfinder paths are within the default firewall, so rememberme f...

---

<div class="post-metadata">

**Author:** ![richmarks20](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/richmarks20/32/7266_2.png) [@richmarks20](https://forum.mautic.org/u/richmarks20)\
**Post date:** [September 6, 2023, 1:48pm UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/38 "2023-09-06T13:48:27Z")

</div>

Likewise, logging in via /s/login has no effect - I regularly get the same error \<1min later.

---

<div class="post-metadata">

**Author:** ![hovirag](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/hovirag/32/11066_2.png) [@hovirag](https://forum.mautic.org/u/hovirag)\
**Post date:** [January 3, 2024, 9:37am UTC](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839/39 "2024-01-03T09:37:57Z")

</div>

it happened to me as well and your suggestion solved the issue

[Previous page](https://forum.mautic.org/t/csrf-token-error-try-to-refresh-the-page-and-try-again/16839.md?page=1)