400 errors on submission (Bad Request: Unable to verify your data submission) CSRF

[DavidStrada]

What happened?

We have 300 to 800 submissions a day, ~ 5% of them throw a 400 error Bad Request: Unable to verify your data submission which refers to CSRF token mismatch, the question is how can this be happening ?

We use blitz and the pages that include FF all of them call dynamic/index to get a new CSRF token along with some FF information, forms are processed using queue option (Use Queue for Email Notifications)

Site is hosted on GCP, uses Kubernetes (pods). Session is store on Redis.

Our setup:

dynamic/index

{% header "Content-Type: application/json; charset=utf-8" %}

{% set rfpForm = craft.app.request.get('form') %}
{% set dynamicRecipients = craft.app.request.get('recipients')| base64DecodeString | split(',') %}
{% set dynamicTemplateToUse = (rfpForm is same as('rfpVenue')) ? 'weddingVenues' : 'weddingVendors' %}

{% set form = craft.freeform.form(rfpForm, {
    dynamicNotification: { recipients: dynamicRecipients, template: dynamicTemplateToUse }
    })
%}

{% do form.registerContext %}

{{ {
    hash: form.hash,
    payload: form.payload,
    csrf: {
        name: craft.app.config.general.csrfTokenName,
        value: craft.app.request.csrfToken,
    }
}|json_encode|raw }}

redis config:

'redis' => [
				'class' => yii\redis\Connection::class,
				'port' => App::env('REDIS_PORT') ?: 6379,
				'hostname' => App::env('REDIS_HOST') ?: 'localhost',
				'database' => 0,
				'retries' => 20,
				'retryInterval' => 500000,
			],
			'cache' => [
				'class' => 'yii\redis\Cache',
				'redis' => 'redis',
			],
			'session' => [
				'class' => yii\redis\Session::class,
				'as session' => craft\behaviors\SessionBehavior::class,
				'redis' => 'redis',
			],

Errors and Stack Trace (if available)

No response

How can we reproduce this?

..

Freeform Edition

Pro

Freeform Version

5.5.4

Craft Version

4.10.5

When did this issue start?

After upgrading from older Freeform version, After upgrading from older Craft version

Previous Freeform Version

3.x

[kjmartens]

Very sorry about this @DavidStrada. We'll have a developer check into it shortly. 🙂

[seandelaney]

@DavidStrada

I see a change that can affect CSRF tokens in Craft 4.10.5

https://github.com/craftcms/cms/releases/tag/4.10.5

Investigating...

[seandelaney]

@DavidStrada Does the RFP forms still work? rfp-form.twig...

[seandelaney]

@DavidStrada

I've replicated the dynamic/index locally, setting fresh CSRF tokens via AJAX just like rfp.js. I installed Blitz and enabled caching. I don't have Cloudflare or Redis setup as I'm doing this all in my local env. I setup a test FF5 form. I cannot replicate the issue. FF5 is working as expected for me. I can see the CSRF changing via AJAX.

• Are the forms working as expected again if you rollback to 4.10.4 - pre CSRF change in Craft ?
• Are the forms working as expected again if you test in a non Cloudflare env (Staging or locally)?
• Are the forms working as expected again if you test in FF4 with Craft 4.10.5?

Have you seen craftcms/cms#15281 and enabled asyncCsrfInputs

[DavidStrada]

@seandelaney Yes I've seen the changes on craft and asyncCsrfInputs is enabled

[DavidStrada]

Are the forms working as expected again if you rollback to 4.10.4 - pre CSRF change in Craft ?

Forms were failing before 4.10.4 and we are on 4.10.5 still failing.

Are the forms working as expected again if you test in a non Cloudflare env (Staging or locally)?

Yes they do work locally, however since this is a 5 - 10% error is very difficult to replicate, and know exactly what's causing the issue, why does it work 95% of the time and fails on some situations? It's not because of extensions on the browser this has happen to people in the organization that have been able to submit plenty of forms successfully and 1 or 2 failed for some reason.

Are the forms working as expected again if you test in FF4 with Craft 4.10.5?

I haven't test this, however I do not think is a matter of FF4 vs FF5 unless the infrastructure behind this changed how form/csrf token is handle aside from validating it in a controller.

[kjmartens]

This does not appear to be an issue with Freeform or Freeform + Blitz. The issues cannot be replicated in testing/investigating. It is related to how the forms are set up, specifically in grabbing and setting CSRF tokens and the usage/storage of cookies/sessions.

Better implementations for getting/setting CSRF tokens within Freeform forms have been suggested via direct message. 🙂