Answers.Body: <p>The CSRF token is likely expiring. Since pages are cached with Blitz, you must  use some strategy to ensure that a fresh CSRF token is loaded into the page on each page that is statically served. The simplest way to do this is to use the <a href="https://putyourlightson.com/plugins/blitz#dynamic-content" rel="nofollow noreferrer">Dynamic Content</a> feature in Blitz, specifically <code>craft.blitz.csrfInput()</code>.</p>
  <pre><code>&lt;form method=&quot;post&quot;&gt;
     {{ craft.blitz.csrfInput() }}
     {# ... #}
   &lt;/form&gt;
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-08-13T06:45:38.040Z
Answers.LastActivityDate: 2021-08-13T06:45:38.040Z
Answers.UserDisplayName: Ben Croker
Body: <p>When a user tries to add something into the cart the following error appears:</p>
  <blockquote>
  <p>400 bad request (&quot;Unable to verify your data submission.&quot;)</p>
  </blockquote>
  <pre><code>2021-02-23 09:08:42 [-][-][fff512a7677a0fcf3272bd46e2fc3270][error][yii\web\HttpException:400] yii\web\BadRequestHttpException: Ihre Dateneingabe konnte nicht überprüft werden oder ist ungültig. in /path/vendor/yiisoft/yii2/web/Controller.php:202
  Stack trace:
  #0 /path/vendor/craftcms/cms/src/web/Controller.php(138): yii\web\Controller-&gt;beforeAction(Object(yii\base\InlineAction))
  #1 /path/vendor/yiisoft/yii2/base/Controller.php(178): craft\web\Controller-&gt;beforeAction(Object(yii\base\InlineAction))
  #2 /path/vendor/craftcms/cms/src/web/Controller.php(190): yii\base\Controller-&gt;runAction('update-cart', Array)
  #3 /path/vendor/yiisoft/yii2/base/Module.php(528): craft\web\Controller-&gt;runAction('update-cart', Array)
  #4 /path/vendor/craftcms/cms/src/web/Application.php(274): yii\base\Module-&gt;runAction('commerce/cart/u...', Array)
  #5 /path/vendor/craftcms/cms/src/web/Application.php(577): craft\web\Application-&gt;runAction('commerce/cart/u...', Array)
  #6 /path/vendor/craftcms/cms/src/web/Application.php(253): craft\web\Application-&gt;_processActionRequest(Object(craft\web\Request))
  #7 /path/vendor/yiisoft/yii2/base/Application.php(386): craft\web\Application-&gt;handleRequest(Object(craft\web\Request))
  #8 /path/www/index.php(32): yii\base\Application-&gt;run()
  #9 {main}
  2021-02-23 09:08:42 [-][-][fff512a7677a0fcf3272bd46e2fc3270][info][application] $_GET = [
      'p' =&gt; 'shop/product'
  ]
  
  $_POST = [
      'action' =&gt; 'commerce/cart/update-cart'
      'redirect' =&gt; 'cbfe8c19da16c2536194408ca0939abfb84103fa6f70889e9e9bddc69715bd14purchase/cart'
      'qty' =&gt; '1'
      
  
  </code></pre>
  <p>It only happens when the browser is kept open for a long time. So I guess the token is renewed on the server but the old token is still in the browser.</p>
  <p>Is there a way to remove the old token brom the client?</p>
  <ul>
  <li>The <a href="https://putyourlightson.com/plugins/blitz" rel="nofollow noreferrer">Blitz</a> plugin installed which caches the product page (But not the cart)</li>
  <li>There is also a Cloudflare in front of the webpage.</li>
  </ul>
  <p>I guess these caching products add to this complexity. Cloudflare might be involved in this as well or probably the main contributor.</p>
  <p>Anyone experienced this?</p>
  
Tags: <cache><plugin-craftcommerce3><csrf><cloudflare><plugin-blitz>
Title: 400 bad request ("Unable to verify your data submission.") when Adding product to cart
ThreadText: # 400 bad request ("Unable to verify your data submission.") when Adding product to cart
  
  (Asked by: username_0 on 2021-02-23)
  
  When a user tries to add something into the cart the following error appears:
  
  > 400 bad request ("Unable to verify your data submission.")
  
  ```
  2021-02-23 09:08:42 [-][-][fff512a7677a0fcf3272bd46e2fc3270][error][yii\web\HttpException:400] yii\web\BadRequestHttpException: Ihre Dateneingabe konnte nicht überprüft werden oder ist ungültig. in /path/vendor/yiisoft/yii2/web/Controller.php:202
  Stack trace:
  #0 /path/vendor/craftcms/cms/src/web/Controller.php(138): yii\web\Controller->beforeAction(Object(yii\base\InlineAction))
  #1 /path/vendor/yiisoft/yii2/base/Controller.php(178): craft\web\Controller->beforeAction(Object(yii\base\InlineAction))
  #2 /path/vendor/craftcms/cms/src/web/Controller.php(190): yii\base\Controller->runAction('update-cart', Array)
  #3 /path/vendor/yiisoft/yii2/base/Module.php(528): craft\web\Controller->runAction('update-cart', Array)
  #4 /path/vendor/craftcms/cms/src/web/Application.php(274): yii\base\Module->runAction('commerce/cart/u...', Array)
  #5 /path/vendor/craftcms/cms/src/web/Application.php(577): craft\web\Application->runAction('commerce/cart/u...', Array)
  #6 /path/vendor/craftcms/cms/src/web/Application.php(253): craft\web\Application->_processActionRequest(Object(craft\web\Request))
  #7 /path/vendor/yiisoft/yii2/base/Application.php(386): craft\web\Application->handleRequest(Object(craft\web\Request))
  #8 /path/www/index.php(32): yii\base\Application->run()
  #9 {main}
  2021-02-23 09:08:42 [-][-][fff512a7677a0fcf3272bd46e2fc3270][info][application] $_GET = [
      'p' => 'shop/product'
  ]
  
  $_POST = [
      'action' => 'commerce/cart/update-cart'
      'redirect' => 'cbfe8c19da16c2536194408ca0939abfb84103fa6f70889e9e9bddc69715bd14purchase/cart'
      'qty' => '1'
      
  
  ```
  
  It only happens when the browser is kept open for a long time. So I guess the token is renewed on the server but the old token is still in the browser.
  
  Is there a way to remove the old token brom the client?
  
  * The [Blitz](https://putyourlightson.com/plugins/blitz) plugin installed which caches the product page (But not the cart)
  * There is also a Cloudflare in front of the webpage.
  
  I guess these caching products add to this complexity. Cloudflare might be involved in this as well or probably the main contributor.
  
  Anyone experienced this?
  
  **Tags:** cache, plugin-craftcommerce3, csrf, cloudflare, plugin-blitz
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-08-13. Score: 1 | Accepted answer
  
  The CSRF token is likely expiring. Since pages are cached with Blitz, you must use some strategy to ensure that a fresh CSRF token is loaded into the page on each page that is statically served. The simplest way to do this is to use the [Dynamic Content](https://putyourlightson.com/plugins/blitz#dynamic-content) feature in Blitz, specifically `craft.blitz.csrfInput()`.
  
  ```
  <form method="post">
     {{ craft.blitz.csrfInput() }}
     {# ... #}
   </form>
  
  ```
  
  
  ---
  
  