Answers.Body: <p>I have exactly the same issue, clearing cookies worked for me</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-09-19T13:05:57.177Z
Answers.LastActivityDate: 2018-09-19T13:05:57.177Z
Answers.UserDisplayName: swalker
Answers.Body: <p>Once the same problem happened for me because of <strong>server caching</strong> and it may happen because of <strong>client-side cookie/cache</strong>. Sometimes, server caching will cache the entire form including CSRF token. So if there any option to use the minimal cache on the server, apply it/remove the server cache option itself. it may fix this problem.</p>
  <blockquote>
  <p>Note: This only my experience. it may be right/wrong.</p>
  </blockquote>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-14T11:09:40.583Z
Answers.LastActivityDate: 2020-07-28T10:27:44.637Z
Answers.LastEditDate: 2020-07-28T10:27:44.637Z
Answers.UserDisplayName: shihab mm
Body: <p>I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my <code>/etc/hosts</code> file on my Mac to point to the IP address for testing. Whilst checking through everything, it seems the site is functioning well, assets have been copied over etc. The only problem is that I am getting an error when trying to log in. </p>
  
  <p>From the front end I get the message: Bad Request: The CSRF token could not be verified.</p>
  
  <pre><code>    2017/07/17 13:52:33 [error] [exception.Craft\HttpException.400] Craft\HttpException: The CSRF token could not be verified. in /home/forge/www.domain.co.uk/craft/app/services/HttpRequestService.php:1337
  Stack trace:
  #0 /home/forge/www.domain.co.uk/craft/app/framework/base/CComponent.php(561): Craft\HttpRequestService-&gt;validateCsrfToken(Object(CEvent))
  #1 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(212): CComponent-&gt;raiseEvent('onbeginrequest', Object(CEvent))
  #2 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(183): CApplication-&gt;onBeginRequest(Object(CEvent))
  #3 /home/forge/www.domain.co.uk/craft/app/index.php(62): CApplication-&gt;run()
  #4 /home/forge/www.domain.co.uk/public/index.php(19): require_once('/home/forge/www...')
  #5 {main}
  REQUEST_URI=/members/login
  HTTP_REFERER=http://www.domain.co.uk/members/login
  ---
  </code></pre>
  
  <p>And from the craft admin login form, this comes up on the console after clicking Login</p>
  
  <p><code>VM43:1 POST http://www.domain.co.uk/index.php?p=admin/actions/users/login 400 (Bad Request)</code></p>
  
  <p>One point to note is that the original website was SSL encrypted but the new server hasn't had an SSL cert installed yet, because DNS is not pointing to it yet. However I have altered the <code>/craft/config/general.php</code> config file to reflect the <code>http://</code> domain.</p>
  
  <p>Any help would be appreciated.
  Running latest craft <code>2.6.2987</code></p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-07-17T14:23:31.393Z
Comments.Text: It sounds like an old value is cached somewhere/how. If you are unable to log into the CP [Check out this thread](https://craftcms.stackexchange.com/questions/6513/manually-clean-database-cache) to manually clear the db cache to see if you can log in.
Comments.UserDisplayName: Damon
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-07-17T14:27:12.537Z
Comments.Text: I cleared the three tables `craft_templatecachecriteria`, `craft_templatecacheelements` & `craft_temlpatecaches` however I still get the same issue.
Comments.UserDisplayName: Adam Menczykowski
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-07-17T14:28:00.347Z
Comments.Text: I also checked to see if any of the login form code is within `{% cache %}` tags but it is not.
Comments.UserDisplayName: Adam Menczykowski
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-07-17T16:57:56.090Z
Comments.Text: Try clearing your browser's cookies. If that doesn't work, what are the domains for Craft's cookies being set to?
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-08-16T12:51:02.710Z
Comments.Text: @BradBell How do we check the domains for Craft's cookies being to sent? (apologies, front end stuff is not my strong stuff)
Comments.UserDisplayName: isral
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-08-16T20:18:49.307Z
Comments.Text: If you're using Chrome, it'll be under the inspector's Application table, then Cookies on the left.  Domain will be a column in the right hand pane.
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-08-17T20:34:00.440Z
Comments.Text: I ran into this when I logged in via http then tried to switch to https. It's like it caches the csrf token, but not the session variable.
Comments.UserDisplayName: ponies
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-28T00:58:48.183Z
Comments.Text: @ponies many thanks, I ran into a similar issue today. Clearing cookies did the trick.
Comments.UserDisplayName: erwinheiser
Tags: <login><server><csrf><https>
Title: Login - Bad Request: The CSRF token could not be verified
ThreadText: # Login - Bad Request: The CSRF token could not be verified
  
  (Asked by: username_0 on 2017-07-17)
  
  I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my `/etc/hosts` file on my Mac to point to the IP address for testing. Whilst checking through everything, it seems the site is functioning well, assets have been copied over etc. The only problem is that I am getting an error when trying to log in.
  
  From the front end I get the message: Bad Request: The CSRF token could not be verified.
  
  ```
      2017/07/17 13:52:33 [error] [exception.Craft\HttpException.400] Craft\HttpException: The CSRF token could not be verified. in /home/forge/www.domain.co.uk/craft/app/services/HttpRequestService.php:1337
  Stack trace:
  #0 /home/forge/www.domain.co.uk/craft/app/framework/base/CComponent.php(561): Craft\HttpRequestService->validateCsrfToken(Object(CEvent))
  #1 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(212): CComponent->raiseEvent('onbeginrequest', Object(CEvent))
  #2 /home/forge/www.domain.co.uk/craft/app/framework/base/CApplication.php(183): CApplication->onBeginRequest(Object(CEvent))
  #3 /home/forge/www.domain.co.uk/craft/app/index.php(62): CApplication->run()
  #4 /home/forge/www.domain.co.uk/public/index.php(19): require_once('/home/forge/www...')
  #5 {main}
  REQUEST_URI=/members/login
  HTTP_REFERER=http://www.domain.co.uk/members/login
  ---
  
  ```
  
  And from the craft admin login form, this comes up on the console after clicking Login
  
  `VM43:1 POST http://www.domain.co.uk/index.php?p=admin/actions/users/login 400 (Bad Request)`
  
  One point to note is that the original website was SSL encrypted but the new server hasn't had an SSL cert installed yet, because DNS is not pointing to it yet. However I have altered the `/craft/config/general.php` config file to reflect the `http://` domain.
  
  Any help would be appreciated.
  Running latest craft `2.6.2987`
  
  **Tags:** login, server, csrf, https
  
  > **Comments:**
  > **username_1**: It sounds like an old value is cached somewhere/how. If you are unable to log into the CP [Check out this thread](https://craftcms.stackexchange.com/questions/6513/manually-clean-database-cache) to manually clear the db cache to see if you can log in.  
  > **username_0**: I cleared the three tables `craft_templatecachecriteria`, `craft_templatecacheelements` & `craft_temlpatecaches` however I still get the same issue.  
  > **username_0**: I also checked to see if any of the login form code is within `{% cache %}` tags but it is not.  
  > **username_2**: Try clearing your browser's cookies. If that doesn't work, what are the domains for Craft's cookies being set to?  
  > **username_3**: @username_2 How do we check the domains for Craft's cookies being to sent? (apologies, front end stuff is not my strong stuff)  
  > **username_2**: If you're using Chrome, it'll be under the inspector's Application table, then Cookies on the left.  Domain will be a column in the right hand pane.  
  > **username_4**: I ran into this when I logged in via http then tried to switch to https. It's like it caches the csrf token, but not the session variable.  
  > **username_5**: @username_4 many thanks, I ran into a similar issue today. Clearing cookies did the trick.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_6 on 2018-09-19. Score: 2
  
  I have exactly the same issue, clearing cookies worked for me
  
  
  ---
  
  ### Answer by username_7 on 2020-07-14. Score: 2
  
  Once the same problem happened for me because of **server caching** and it may happen because of **client-side cookie/cache**. Sometimes, server caching will cache the entire form including CSRF token. So if there any option to use the minimal cache on the server, apply it/remove the server cache option itself. it may fix this problem.
  
  > Note: This only my experience. it may be right/wrong.
  
  
  ---
  
  