nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Invalid CSRF token. Please try again.

rekabis

I am able to make questions.

But any attempt to add a comment to a question, or as a reply, throws this error.

Like, there doesn’t seem to be any errors on these forums except that.

I have followed all the best-practices for resolving this issue, including opening up dangerously permissive cookie settings and clearing the cache.

Edit: I have been unable to make any comments TODAY. Prior comments from months ago obviously don’t count. I am literally unable to respond to the copilot screenshot guy, below.

Find more posts tagged with

Community

Accepted answers

All comments

Chris_QPW

Take this for what it worth since it is an answer from Copilot and I'm certainly not in the position to confirm it is correct. With that said:

I will note that you have been able to make some comments, because I can see that you have made 4 of them so far besides your posting of questions when I look at your profile.

mshiggins

@rekabis have you tried using a different browser and/or a different device?

rekabis

Trying a “near-naked” web browser now, with this comment.

If this comment posts, then these community forums have a broken implementation of CSRF. As a developer I interact with many CSRF-protected forms across many websites on a daily basis, and these community forums are the first place where forms have broken for me in a damn long time.

Edit: Looks like the comment successfully posted.

If this problem happened dozens of times a day across dozens of websites, I would agree that it’s a browser setting involving my anti-adware, anti-spyware, or anti-malware add-ins. But it doesn’t happen anywhere except on this site, and this is the first time I have ever seen a CSRF error anywhere aside from a personal project that is still under construction.

So following Ockham’s Razor, these community forums have a broken implementation that doesn’t crop up for most people because their browser security is naïvely non-existent.

rekabis

I made those comments many months to years ago. Wasn’t that a strong indication they should be discounted/ignored?

Working from a “near-naked” web browser to post this. As per another comment in this thread, Ockham’s Razor is pointing quite unambiguously towards this forum’s CSRF implementation being broken in some way.

Sceptic

@rekabis your comment -

I have followed all the best-practices for resolving this issue, including opening up dangerously permissive cookie settings and clearing the cache.

is very telling. CSRF tokens need cookies to work. Ensure cookies are enabled for this website.

rekabis

>Ensure cookies are enabled for this website.

Did I not state that I did exactly that, with zero success? Hell, you quoted me saying exactly that.

As per another reply in this thread, as a dev I encounter CSRF-protected forms across hundreds of websites on the regular. This site is the only place where they are failing. Ockham’s Razor clearly lays the issue at the feet of an incorrect or broken implementation.

Chris_QPW

I noticedI noticed that really locked down the machine. I suspect it's something like that. Not that I'm saying that the site is doing the right thing or anything. One thing to be aware of is that Quicken Inc doesn't write their own website. This is a third party forum software.

rekabis

> Quicken Inc doesn't write their own website. This is a third party forum software.

I am aware of that, other sites I use also have similar-behaving/looking forums and those don’t throw a CSRF error.

As I said elsewhere in this thread: If it happened all the time, it’s obviously a me problem. If I can go years and hundreds of sites without hitting the same problem, it’s a THEM problem.

Sceptic

Do you have your browser settings to automatically clear history, cookies, cache, etc.? Even though you enabled cookies for this site, your browser setting can undo it. I suspect you were able to comment with a "near naked" browser because the automatic clearing wasn't taking place.

Chris_QPW

The problem with that statement is that you are the first person that has ever complained that I have seen on this forum. So even though I definitely agree that there is a forum problem, it is certainly not what you would call a common problem. And therefore sure it should be reported to their third party software vendor, but there's obviously something that you are doing that is different than everybody else.

rekabis

>you are the first person that has ever complained that I have seen on this forum.

I work in the security end of IT. My browser is locked down very tightly, but in ways that it still works 100% with correctly-configured web resources. So it will go sideways if something isn’t configured correctly, or is configured maliciously. An that is on purpose, so I can tell when something is Not Right with a web resource regardless if it is someone else’s site or a project I am working on.