This POSTed request was attempted without a valid authenticity token.

[gkiller]

Scratching my head over this one... I have a very simple login form that outputs the error noted in the discussion title.

• Only occurs if protectfromForgery() is enabled in Controller.cfc or when using super.config() in another controller. When these are not used, login is successful.
• Network traffic payload shows a token being passed: authenticityToken: 74FCE31B9B06338133015250E054BE0F0F657A1F
• Routes have been verified. Also changed the method to POST and still get the same error

What is causing this?

Here's the form:

 #startFormTag(route="authenticate-login", method="patch")#

        #textFieldTag(
            label="Enter Your Username",
            name="username",
            labelPlacement="before"
        )#

        #passwordFieldTag(
            label="Enter Your Password",
            name="password",
            labelPlacement="before"
        )#
 
        <div>#submitTag(value="Login")#</div>

 #endFormTag()# 

and a basic controller for authentication

component extends='Controller' {

    public function config(){
        super.config();
    }

    public struct function login(){
        
        member = model('Member').authenticateUser(params.username, params.password);

       //  do other stuff here
   }
}

[chapmandu]

What are your CSRF storage settings? If your server can't store the token to compare it will always fail.

FWIW.. Mine are configured in config/settings.cfm like so:

// csrf
set(csrfStore = "cookie");
set(csrfCookieEncryptionSecretKey = "your_own_key_here");

Have a look through the CSRF configuration options here to see if they line up with your session/cookie configuration.

https://guides.cfwheels.org/cfwheels-guides/working-with-cfwheels/configuration-and-defaults

[gkiller]

CSRF is currently set to session (by default). I also noticed this error occurred when this.setClientCookies = false in config/app.cfm. When set to true it works, but we've had some test apps that have it set to false without producing the error. Odd, since this is just a very simple test build.