Invalid Security Token

[legas1]

Hello devs,

I just setup site on my web provider hosting (subdomain) and registered to admin page, but the main page was trapped in loop, so I configured custom base url to correspond with my subdomain... and it worked.
But after I reloaded the admin page and logged in, the page only says Invalid Security Token. Screen here

Some possibly relevant Info:

• Installed manually by copying via FTP
• Grav and admin version are latest (releases) prior to today (1.1.15 and 1.2.10)
• I am using Chrome and I also cleared sessions/cookies for my subdomain
• PHP 7.0.5
• Subdomains on my web provider hosting are handled in subdom folder as folders and then rewritten by .htaccess to act as subdomain.
• Without configuring custom base url, admin page is alright.

Thank you very much and I hope to receive your reply and possible solution soon.

[legas1]

Well, I am not mastered in PHP scripting and this stuff, but I have tried to reproduce it by creating localhost subdomain and route subdirectory to subdomain.localhost, not exactly the same result as on web provider hosting, but it looks like wrong routing happening somewhere... Screen here

Btw: default home page working properly.

[flaviocopes]

Can you try installing a Grav instance in a subfolder on your main domain, to check if it's a problem related to the subdomain configuration, or a general server config issue?

[ilCoso]

Hi everybody,

same problem here. Fresh install gives me this error:

Request URL:https://www.ilcoso.org/admin/notifications.json/task:processNotifications
Request Method:POST
Status Code:403 Forbidden
Remote Address:107.6.154.186:443

The response is:

{"status":"error","message":"Token di sicurezza non valido"}

[legas1]

Sorry for the late response... yes, that works good, but still not sure if its related to the web host redirecting configuration. However I noticed that error is produced on line 148 in adminbasecontroller.php. I have also found something about using $_SERVER["REQUEST_URI"] instead of $_SERVER["PHP_SELF"] and $_SERVER["SCRIPT_NAME"] on web host wiki, because it points to the current path of subdomain directory instead of redirected path of subdomain... but it can be unrelated. Anyways thank you for looking further on this possible issue.

[legas1]

Ok guys, I just managed to configure it properly, it seems the issue is cookie path...
In default it looks like:

After I set system.yaml's session.path property to for example local tmp folder and clear cookies, it works and no Invalid Security Token appears.

Try something like that @ilCoso as a workaround.

[flaviocopes]

Thanks @Noah1911 that's definitely something that can cause of the problem, if PHP cannot correctly access the temp folder to store the session. @ilCoso can you check if your problem is the same?

[ilCoso]

if I set tmp in system.yaml session.path the page keeps reload with this message

The odd thing is that if I rollback and delete tmp from system.yaml the admin page keeps reload...
I have also tried with 'tmp/' and '/tmp'.

[ilCoso]

Ok, forget my last post. I have cleaned everything (server-side cache, client-side cache and cookies) and I have successfully rollbacked. Now my cookies looks like these, but the problem still remains.

[bmuessig]

I am facing the same problem, but there does not seem to be a working solution for me.
The only difference is that I am getting a 503 not a 403.

[Syakyr]

Hi, anybody managed to resolve the problem? I'm still at a loss here; I can log in to the admin panel when I use my internal IP address, but when I do that using my domain name, it gives me the invalid security token error. I did the session.path = tmp patch, but it still doesn't work. Changing base_url screws up the site by doing too many redirects. Currently running Grav on my OrangePi, proxied to my main server.

[SandroBerger]

Hey :-)

is there already a solution available for this problem?
I've installed grav on 2 different webhosting

[SandroBerger]

sry clicked on Comment to early

*providers. On the first one it works all fine and logging in is no problem. But on the second one i can only login with Chrome. On iPhone, Firefox or Edge it is not working there is alwasy the message "Invalid Security Token"

Thanks for any help.

Regards Sandro

[riemers]

I also have this screen, i thought i fixed it with using 304 as rewrites but it failed on me later. When checking the 'form data' post i see that it uses this:

task:login
redirect:http://unknown/admin

So i presume this is also a reason why things fail, if i play around with settings that would be the redirect of my domain. For some reason it cannot properly detect the uri.route which is used to create the redirect url (as far as i can tell from themes/grav/templates/partials/login.html.twig)

p.s. i am using a reverse proxy in front of grav, using a full domain xxx.domain.com, so no /subs/

[aisbergg]

Same thing here. I use HAProxy in front of the webserver. I am not a PHP developrt but I was able to pin the problem . In system/src/Grav/Common/Session.php the varible $this->grav['uri']; not always reports the right host like $_SERVER[HTTP_HOST] does. It just prints out unknown.

So after I changed the $domain variable that is used for the cockie creation to $_SERVER[HTTP_HOST] it magically works again.

[rhukster]

Where exactly? $this->grav['uri'] is the URI object, it's not a string value of the uri directly.

[aisbergg]

I observed that the domain part in the cookie was set wrong (unknown). It lead me to the system/src/Grav/Common/Session.php where the cookie is set.
What I noticed is that the $uri is set to the value of $this->grav['uri']. The value provided by $this->grav['uri'] already provides the wrong host:

<?php
...
    public function init()
    {
        /** @var Uri $uri */
        $uri = $this->grav['uri']; // value is: https://unknown:80/
                                   // value of $_SERVER[HTTP_HOST] is: grav_twenty.dev.local
        $config = $this->grav['config'];

        $is_admin = false;
        $base_url = $uri->rootUrl(false);
...
?>

The host part of the $uri is then used as domain in the cookie:

$domain = $uri->host();
...
setcookie(session_name(), session_id(), $session_timeout ? time() + $session_timeout : 0, $session_path, $domain, $secure, $httponly);

This way Grav complains with Invalid Security Token. I don't know about the worklfow, I mean when the session is created and what comes before so I can't trace it back further.

[aisbergg]

Ok, my fault. The issue was an invalid hostname. Apparently an underscore is not allowed in hostnames and therfore Grav will set the hostname to unknown

[JOduMonT]

might odd and not really related but
but I move from prod to dev my site and had this error;

obviously in prod I have a valid ssl
and in dev I don't have a ssl certificate

so to fix this I change to setting in my system.yaml which are:

force_ssl: false # which is at true in prod

session
  secure: false # it is at true in prod

I hope that help someone and/or give a least some hint like this post did to me.

[tacoen]

Hi, I upgrade to Grav 1.77 and This problem all back again.

For my localhost

in my system.yaml

session:
  enabled: enable
  initialize: true
  timeout: 3600
  name: gravsite1
  secure: false
  httponly: true
  samesite: Lax
  split: true
  path: null

If I set path to 'tmp' I will got Invalid security token notice.

if the path is 'null' then ERR_CONNECTION_RESET

my localhost's apache error.log show a lot :

[Sun Feb 28 16:21:05.569810 2021] [php7:notice] [pid 11052:tid 1936] [client 127.0.0.1:8503] GuzzleHttp\\Exception\\RequestException: cURL error 60: SSL certificate problem: unable to get local issuer certificate (see http://curl.haxx.se/libcurl/c/libcurl-errors.html) in D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Handler\\CurlFactory.php:186\nStack trace:\n#0 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Handler\\CurlFactory.php(149): GuzzleHttp\\Handler\\CurlFactory::createRejection(Object(GuzzleHttp\\Handler\\EasyHandle), Array)\n#1 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Handler\\CurlFactory.php(102): GuzzleHttp\\Handler\\CurlFactory::finishError(Object(GuzzleHttp\\Handler\\CurlHandler), Object(GuzzleHttp\\Handler\\EasyHandle), Object(GuzzleHttp\\Handler\\CurlFactory))\n#2 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Handler\\CurlHandler.php(43): GuzzleHttp\\Handler\\CurlFactory::finish(Object(GuzzleHttp\\Handler\\CurlHandler), Object(GuzzleHttp\\Handler\\EasyHandle), Object(GuzzleHttp\\Handler\\CurlFactory))\n#3 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Handler\\Proxy.php(28): GuzzleHttp\\Handler\\CurlHandler->__invoke(Object(GuzzleHttp\\Psr7\\Request), Array)\n#4 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Handler\\Proxy.php(51): GuzzleHttp\\Handler\\Proxy::GuzzleHttp\\Handler\\{closure}(Object(GuzzleHttp\\Psr7\\Request), Array)\n#5 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\PrepareBodyMiddleware.php(37): GuzzleHttp\\Handler\\Proxy::GuzzleHttp\\Handler\\{closure}(Object(GuzzleHttp\\Psr7\\Request), Array)\n#6 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Middleware.php(30): GuzzleHttp\\PrepareBodyMiddleware->__invoke(Object(GuzzleHttp\\Psr7\\Request), Array)\n#7 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\RedirectMiddleware.php(70): GuzzleHttp\\Middleware::GuzzleHttp\\{closure}(Object(GuzzleHttp\\Psr7\\Request), Array)\n#8 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\RedirectMiddleware.php(107): GuzzleHttp\\RedirectMiddleware->__invoke(Object(GuzzleHttp\\Psr7\\Request), Array)\n#9 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\RedirectMiddleware.php(72): GuzzleHttp\\RedirectMiddleware->checkRedirect(Object(GuzzleHttp\\Psr7\\Request), Array, Object(GuzzleHttp\\Psr7\\Response))\n#10 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\promises\\src\\FulfilledPromise.php(39): GuzzleHttp\\RedirectMiddleware->GuzzleHttp\\{closure}(Object(GuzzleHttp\\Psr7\\Response))\n#11 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\promises\\src\\TaskQueue.php(47): GuzzleHttp\\Promise\\FulfilledPromise::GuzzleHttp\\Promise\\{closure}()\n#12 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\promises\\src\\Promise.php(246): GuzzleHttp\\Promise\\TaskQueue->run(true)\n#13 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\promises\\src\\Promise.php(223): GuzzleHttp\\Promise\\Promise->invokeWaitFn()\n#14 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\promises\\src\\Promise.php(62): GuzzleHttp\\Promise\\Promise->waitIfPending()\n#15 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\guzzlehttp\\guzzle\\src\\Client.php(131): GuzzleHttp\\Promise\\Promise->wait()\n#16 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\debril\\feed-io\\src\\FeedIo\\Adapter\\Guzzle\\Client.php(75): GuzzleHttp\\Client->request('get', 'http://rss.nyti...', Array)\n#17 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\debril\\feed-io\\src\\FeedIo\\Reader.php(124): FeedIo\\Adapter\\Guzzle\\Client->getResponse('http://rss.nyti...', Object(DateTime))\n#18 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\vendor\\debril\\feed-io\\src\\FeedIo\\FeedIo.php(321): FeedIo\\Reader->read('http://rss.nyti...', Object(FeedIo\\Feed), Object(DateTime))\n#19 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\classes\\Parser.php(107): FeedIo\\FeedIo->read('http://rss.nyti...')\n#20 D:\\UniServerZ\\vhosts\\grav-src\\user\\plugins\\twigfeeds\\twigfeeds.php(208): Grav\\Plugin\\TwigFeedsPlugin\\API\\Parser->parseFeed(Array, 'D:/UniServerZ/v...')\n#21 D:\\UniServerZ\\vhosts\\grav-src\\vendor\\symfony\\event-dispatcher\\EventDispatcher.php(264): Grav\\Plugin\\TwigFeedsPlugin->outputFeeds(Object(RocketTheme\\Toolbox\\Event\\Event), 'onTwigSiteVaria...', Object(Symfony\\Component\\EventDispatcher\\EventDispatcher))\n#22 D:\\UniServerZ\\vhosts\\grav-src\\vendor\\symfony\\event-dispatcher\\EventDispatcher.php(239): Symfony\\Component\\EventDispatcher\\EventDispatcher->doDispatch(Array, 'onTwigSiteVaria...', Object(RocketTheme\\Toolbox\\Event\\Event))\n#23 D:\\UniServerZ\\vhosts\\grav-src\\vendor\\symfony\\event-dispatcher\\EventDispatcher.php(73): Symfony\\Component\\EventDispatcher\\EventDispatcher->callListeners(Array, 'onTwigSiteVaria...', Object(RocketTheme\\Toolbox\\Event\\Event))\n#24 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Common\\Grav.php(550): Symfony\\Component\\EventDispatcher\\EventDispatcher->dispatch(Object(RocketTheme\\Toolbox\\Event\\Event), 'onTwigSiteVaria...')\n#25 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Common\\Twig\\Twig.php(376): Grav\\Common\\Grav->fireEvent('onTwigSiteVaria...')\n#26 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Common\\Service\\OutputServiceProvider.php(36): Grav\\Common\\Twig\\Twig->processSite('html')\n#27 D:\\UniServerZ\\vhosts\\grav-src\\vendor\\pimple\\pimple\\src\\Pimple\\Container.php(118): Grav\\Common\\Service\\OutputServiceProvider->Grav\\Common\\Service\\{closure}(Object(Grav\\Common\\Grav))\n#28 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Common\\Processors\\RenderProcessor.php(39): Pimple\\Container->offsetGet('output')\n#29 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Framework\\RequestHandler\\Traits\\RequestHandlerTrait.php(50): Grav\\Common\\Processors\\RenderProcessor->process(Object(Nyholm\\Psr7\\ServerRequest), Object(Grav\\Framework\\RequestHandler\\RequestHandler))\n#30 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Framework\\RequestHandler\\Traits\\RequestHandlerTrait.php(62): Grav\\Framework\\RequestHandler\\RequestHandler->handle(Object(Nyholm\\Psr7\\ServerRequest))\n#31 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Common\\Processors\\DebuggerAssetsProcessor.php(38): Grav\\Framework\\RequestHandler\\RequestHandler->handle(Object(Nyholm\\Psr7\\ServerRequest))\n#32 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Framework\\RequestHandler\\Traits\\RequestHandlerTrait.php(50): Grav\\Common\\Processors\\DebuggerAssetsProcessor->process(Object(Nyholm\\Psr7\\ServerRequest), Object(Grav\\Framework\\RequestHandler\\RequestHandler))\n#33 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Framework\\RequestHandler\\Traits\\RequestHandlerTrait.php(62): Grav\\Framework\\RequestHandler\\RequestHandler->handle(Object(Nyholm\\Psr7\\ServerRequest))\n#34 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Common\\Processors\\PagesProcessor.php(81): Grav\\Framework\\RequestHandler\\RequestHandler->handle(Object(Nyholm\\Psr7\\ServerRequest))\n#35 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Framework\\RequestHandler\\Traits\\RequestHandlerTrait.php(50): Grav\\Common\\Processors\\PagesProcessor->process(Object(Nyholm\\Psr7\\ServerRequest), Object(Grav\\Framework\\RequestHandler\\RequestHandler))\n#36 D:\\UniServerZ\\vhosts\\grav-src\\system\\src\\Grav\\Framework\\RequestHandler\\Traits\\RequestHandlerTrait.php(62): Grav\\Framework\\RequestHandler\\RequestHandler->handle(Object(Nyholm\\Psr7\\ServerRequest))\n#37 D:\\UniServerZ\\vhosts\\g

:( to solve the problem is by deleting my account .yaml everytime.

So, i decide to do clean install of grav 1.77 on localhost that run with ssl, and the problem solved.

Someone had to tell that grav 1.77 auth session only run in https

[jleaders]

No matter what I tried, I had to just uninstall php7.4-fpm and get php8.0-fpm to get past this error. (nginx over caddy proxy Ubuntu 20.04)
Cookies & sessions worked fine, permissions were right, and I could even log in, but then all subsequent queries/activities would pop up Invalid Security Token (like the newsfeed etc)

[mahagr]

Both ERR_CONNECTION_RESET and changing PHP version sounds like there may be a PHP bug, which caused this.

[jleaders]

@mahagr My thoughts as well. I'd be mildly curious if anyone else was seeing this on 7.4 fpm

[maofree]

Hi
from some days I get the same problem "Invalid Security Token", the problem happens after 1 days from the last login.
it is a bug of grav cms not from php, I use other cms each days without any problems.
on my local server all is ok in the first day but if I wait some time to do the next login I get this error.

I tried to remove all cookies from chrome

to fix this problem I need to remove the account file and recreat it to get the login or use the comand
bin/grav clearcache

is it possible to fix this problem?

bye

[mahagr]

It's not a bug but a security feature. Security tokens are used to prevent session hijacking and they expire after a day.