Security Error: Invalid _CSRFToken

Hi wevolutions, 

Sometimes I come across this error when there's an http/https mismatch, which is something that may differ between browsers. Can you try on chrome using the HTTPS url and let me know if that fixes the issue?

Thanks,

Both http and https give the same error. It does not happen with other browsers so I am guessing there may be some issue with my Google Chrome.

Hi wevolutions,

That is very curious that it would only happen in Chrome. Do you have another computer you could use to see if it's machine-specific? Or you can send us a 2nd-level support request (https://www.interactivetools.com/support/request/) with the instructions to reproduce the issue and we can try out a few browsers on our end. If it's happening in Chome in general, it'd be worth finding the source of the issue.

Thanks,

It happens ONLY in Chrome and it is machine specific. Other computers and browsers work just fine. I cleared the cache many times, I deleted cookies, Google Chrome has the latest version running, I am not sure what to do again. I should figure it out soon enough.

UPDATE: The issue is with using the Flash Uploader on Google Chrome.

I usually have about 10 photos to upload at one time so I use the flash uploader which makes it very easy to do this.

Since a few days ago, this issue started happening with the Security Error.

Is there an updated version to allow multiple file uploads at one time without using the flash uploader?

Is there an updated version to allow multiple file uploads at one time without using the flash uploader?

Yes, the flash uploader was replaced a number of years ago.

You can get the latest version of CMS Builder here:
https://www.interactivetools.com/upgrade/

Here are instructions for upgrading CMS Builder:
https://www.interactivetools.com/docs/cmsbuilder/upgrade.php

And if you have any questions about the upgrade process or need any assistance with that, just let us know.

Thanks!

Hi Kenny,

You're right in that this error can be due to a timeout; the CSRF token is stored in a session variable that will expire after ~24 minutes with default PHP settings. This particular case is a bit of an outlier as it's only happening in one browser, but if you see it pop up after a period of inactivity, it's likely due to the timeout. The PHP config setting that controls this is gc_maxlifetime (https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime) if you ever want to adjust it on your server. (Note: the name is a bit misleading; this is the number of seconds after which a session will be considered "expired," however, expired sessions aren't always cleaned up immediately, so they could remain active for longer)

I have noticed this issue come up for a number of users, so I've raised it internally to see if we can come up with a way to improve how we store this, and possibly reduce how often these false timeouts show up.

Thanks for the feedback!