Body: <p>The question isn't that relevant to Craft's scope but it bounds to understand How entry from front end is processed... I think.</p>
  
  <p>Thanks to P&amp;T I'm learning on <a href="https://github.com/pixelandtonic/GuestEntries" rel="nofollow noreferrer">GuestEntries</a> plugin to send a POST request using <a href="https://www.ampproject.org/docs/reference/components/amp-form" rel="nofollow noreferrer">AMP-FORM</a>. A validation and sending is done via their JavaScript where XHR request is sent without a full load of the page. So AJAX request.
  One of AMP's requirements were to set a <code>headers</code> for <a href="https://github.com/ampproject/amphtml/blob/master/spec/amp-cors-requests.md" rel="nofollow noreferrer">CORS</a> requests.</p>
  
  <p>So I set the header in my .htaccess file like this:</p>
  
  <pre><code>Header set AMP-Access-Control-Allow-Source-Origin "https://example.craft.dev"
  </code></pre>
  
  <p>With no <code>header</code> set I couldn't pass through validation.</p>
  
  <p>After fulfilling AMP's requirements to submit a AMP-FORM I get this error:</p>
  
  <pre><code>POST https://example.craft.dev/someURI/send?__amp_source_origin=https%3A%2F%2Fexample.craft.dev 
  400 (Bad Request)
  </code></pre>
  
  <p>This is my simple form I'm sending:</p>
  
  <pre><code>&lt;form method="post" action-xhr="{{ craft.request.url }}" target="_top" accept-charset="UTF-8" enctype="multipart/form-data"&gt;
  
      &lt;!-- {{ getCsrfInput() }} --&gt;
  
      &lt;input type="hidden" name="action" value="guestEntries/saveEntry"&gt;
      &lt;input type="hidden" name="sectionId" value="18"&gt;
      &lt;input type="text" name="title"&gt;
  
      &lt;input type="submit" value="Send"&gt;
  
  &lt;/form&gt;
  </code></pre>
  
  <p>I had to comment <code>getCsrfInput()</code> because It was throwing me an error about some polifiling JSON or something.
  I hope You folks can give me some pointers Whether Craft can handle it.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-12-06T21:59:59.777Z
Comments.Text: I've got 0 experience with AMP, but I'd guess you're getting the 400 bad request response because you've commented out the `getCsrfInput()`, which includes the CSRF token. I'd put that back in and troubleshoot the original error you received.
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-12-07T08:55:18.520Z
Comments.Text: @Brad Bell I've commented out the `getCsrfInput()` because a token is created by their JavaScript. But thanks for joining in Brad. I'll try to troubleshoot it even with guys from AMP team.
Comments.UserDisplayName: Dominik Krulak
Tags: <plugin-guestentries>
Title: Posting a Guest Entry using AMP
ThreadText: # Posting a Guest Entry using AMP
  
  (Asked by: username_0 on 2016-12-06)
  
  The question isn't that relevant to Craft's scope but it bounds to understand How entry from front end is processed... I think.
  
  Thanks to P&T I'm learning on [GuestEntries](https://github.com/pixelandtonic/GuestEntries) plugin to send a POST request using [AMP-FORM](https://www.ampproject.org/docs/reference/components/amp-form). A validation and sending is done via their JavaScript where XHR request is sent without a full load of the page. So AJAX request.
  One of AMP's requirements were to set a `headers` for [CORS](https://github.com/ampproject/amphtml/blob/master/spec/amp-cors-requests.md) requests.
  
  So I set the header in my .htaccess file like this:
  
  ```
  Header set AMP-Access-Control-Allow-Source-Origin "https://example.craft.dev"
  
  ```
  
  With no `header` set I couldn't pass through validation.
  
  After fulfilling AMP's requirements to submit a AMP-FORM I get this error:
  
  ```
  POST https://example.craft.dev/someURI/send?__amp_source_origin=https%3A%2F%2Fexample.craft.dev 
  400 (Bad Request)
  
  ```
  
  This is my simple form I'm sending:
  
  ```
  <form method="post" action-xhr="{{ craft.request.url }}" target="_top" accept-charset="UTF-8" enctype="multipart/form-data">
  
      <!-- {{ getCsrfInput() }} -->
  
      <input type="hidden" name="action" value="guestEntries/saveEntry">
      <input type="hidden" name="sectionId" value="18">
      <input type="text" name="title">
  
      <input type="submit" value="Send">
  
  </form>
  
  ```
  
  I had to comment `getCsrfInput()` because It was throwing me an error about some polifiling JSON or something.
  I hope You folks can give me some pointers Whether Craft can handle it.
  
  **Tags:** plugin-guestentries
  
  > **Comments:**
  > **username_1**: I've got 0 experience with AMP, but I'd guess you're getting the 400 bad request response because you've commented out the `getCsrfInput()`, which includes the CSRF token. I'd put that back in and troubleshoot the original error you received.  
  > **username_0**: @username_1 I've commented out the `getCsrfInput()` because a token is created by their JavaScript. But thanks for joining in username_1. I'll try to troubleshoot it even with guys from AMP team.  
  
  ---
  
  ## 0 answers
  
  