Answers.Body: <p>Completely untested, but try setting the recently added <a href="http://buildwithcraft.com/docs/config-settings#useSecureCookies" rel="nofollow">useSecureCookies</a> setting to <code>false</code> and see if that works.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-03-12T16:57:09.513Z
Answers.LastActivityDate: 2015-03-12T16:57:09.513Z
Answers.UserDisplayName: Brad Bell
Body: <p>I have the following scenario:</p>
  
  <ul>
  <li>A page is loaded via HTTP</li>
  <li>The user fills out a form and submits its contents via HTTPS</li>
  <li>The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is submitted along with the form</li>
  <li>Craft responds with a HTTP 400, because the Token is not valid for the request being send over HTTPS</li>
  </ul>
  
  <p>Is there a way to use Crafts CSRF prevention feature in this scenaria? So say for example tell Craft to generate the token for an expected HTTPS request?</p>
  
  <p>Regards,
  Clemens</p>
  
Tags: <csrf><https>
Title: Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token
ThreadText: # Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token
  
  (Asked by: username_0 on 2015-02-27)
  
  I have the following scenario:
  
  * A page is loaded via HTTP
  * The user fills out a form and submits its contents via HTTPS
  * The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is submitted along with the form
  * Craft responds with a HTTP 400, because the Token is not valid for the request being send over HTTPS
  
  Is there a way to use Crafts CSRF prevention feature in this scenaria? So say for example tell Craft to generate the token for an expected HTTPS request?
  
  Regards,
  username_0
  
  **Tags:** csrf, https
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-03-12. Score: 1
  
  Completely untested, but try setting the recently added [useSecureCookies](http://buildwithcraft.com/docs/config-settings#useSecureCookies) setting to `false` and see if that works.
  
  
  ---
  
  