Answers.Body: <p>Enable CSRF protection in your config again and add <code>{{ getCsrfInput() }}</code> right after the <code>&lt;form&gt;</code> opening tag on <em>all</em> forms on your site, regardless if they are amforms or mailchimp subscribe.  I can verify that it won't interfere with the mailchimp plugin as I am currently (and just recently) installed it on a project I'm working on and it works fine.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-09-27T14:50:10.647Z
Answers.Text: Excellent, thank you. I can confirm it's working perfectly.
Answers.UserDisplayName: Sam
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-09-27T14:43:58.857Z
Answers.LastActivityDate: 2017-09-27T14:43:58.857Z
Answers.UserDisplayName: Ryan
Body: <p>I'm using the <a href="https://github.com/aelvan/mailchimp-subscribe-craft" rel="nofollow noreferrer">MailChimp Subscribe for Craft</a> plugin to embed several subscription forms on a website I'm building. </p>
  
  <p>The following code appears via my master <code>_layout.html</code> file:</p>
  
  <pre><code>&lt;form action="" method="POST"&gt;
  
      &lt;input type="hidden" name="action" value="mailchimpSubscribe/list/Subscribe"&gt;
      &lt;input type="hidden" name="redirect" value="successfully-subscribed"&gt;
  
      {# MailChimp List ID #}
      &lt;input type="hidden" name="lid" value="XXXXXXXXXX"&gt;
  
      {% if mailchimpSubscribe is defined %}
          {% if (not mailchimpSubscribe.success) and (mailchimpSubscribe.errorCode!='1000') %}
              &lt;p&gt;An error occured. Please try again.&lt;/p&gt;
          {% endif %}
      {% endif %}
  
      &lt;div class="field-line"&gt;
          &lt;label&gt;Name&lt;/label&gt;
          &lt;input type="text" placeholder="Name" name="mcvars[NAME]" value="{% if (mailchimpSubscribe is defined) and (not mailchimpSubscribe.success) %}{{ mailchimpSubscribe.values.vars.NAME }}{% endif %}" required&gt;
      &lt;/div&gt;
  
      &lt;div class="field-line"&gt;
          &lt;label{% if (mailchimpSubscribe is defined) and (mailchimpSubscribe.errorCode=='1000') %} class="error"{% endif %}&gt;Email:&lt;/label&gt;
          &lt;input type="email" placeholder="Email Address" name="email" value="{% if (mailchimpSubscribe is defined) and (not mailchimpSubscribe.success) %}{{ mailchimpSubscribe.values.email }}{% endif %}" required&gt;
      &lt;/div&gt;
  
      &lt;input type="submit" name="" value="Go!"&gt;
  
  &lt;/form&gt;
  </code></pre>
  
  <p>When I hit go, I get the following Bad Request error:</p>
  
  <p><a href="https://i.sstatic.net/NyouD.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/NyouD.jpg" alt="Bad Request"></a></p>
  
  <p>I've temporarily fixed the error via <code>general.php</code> by disabling CSRF Protection (not recommended).</p>
  
  <p>How do I implement CSRF Protection on this form? I've followed <a href="https://craftcms.com/support/csrf-protection" rel="nofollow noreferrer">this article</a>, but replacing the name and value fields will surely disable the plugin's functionality?</p>
  
  <p>Should I also implement the method shown <a href="https://craftcms.com/support/csrf-protection" rel="nofollow noreferrer">here</a> for other forms like <a href="https://github.com/am-impact/amforms" rel="nofollow noreferrer">Am Forms</a>?</p>
  
  <p><strong>Update:</strong>
  There's a pull request on the <a href="https://github.com/aelvan/mailchimp-subscribe-craft/pull/43" rel="nofollow noreferrer">plugin git page</a> regarding this.</p>
  
Tags: <form><security><csrf><plugin-amforms><plugin-mailchimpsubscribe>
Title: Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms
ThreadText: # Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms
  
  (Asked by: username_0 on 2017-09-27)
  
  I'm using the [MailChimp Subscribe for Craft](https://github.com/aelvan/mailchimp-subscribe-craft) plugin to embed several subscription forms on a website I'm building.
  
  The following code appears via my master `_layout.html` file:
  
  ```
  <form action="" method="POST">
  
      <input type="hidden" name="action" value="mailchimpSubscribe/list/Subscribe">
      <input type="hidden" name="redirect" value="successfully-subscribed">
  
      {# MailChimp List ID #}
      <input type="hidden" name="lid" value="XXXXXXXXXX">
  
      {% if mailchimpSubscribe is defined %}
          {% if (not mailchimpSubscribe.success) and (mailchimpSubscribe.errorCode!='1000') %}
              <p>An error occured. Please try again.</p>
          {% endif %}
      {% endif %}
  
      <div class="field-line">
          <label>Name</label>
          <input type="text" placeholder="Name" name="mcvars[NAME]" value="{% if (mailchimpSubscribe is defined) and (not mailchimpSubscribe.success) %}{{ mailchimpSubscribe.values.vars.NAME }}{% endif %}" required>
      </div>
  
      <div class="field-line">
          <label{% if (mailchimpSubscribe is defined) and (mailchimpSubscribe.errorCode=='1000') %} class="error"{% endif %}>Email:</label>
          <input type="email" placeholder="Email Address" name="email" value="{% if (mailchimpSubscribe is defined) and (not mailchimpSubscribe.success) %}{{ mailchimpSubscribe.values.email }}{% endif %}" required>
      </div>
  
      <input type="submit" name="" value="Go!">
  
  </form>
  
  ```
  
  When I hit go, I get the following Bad Request error:
  
  [![Bad Request](https://i.sstatic.net/NyouD.jpg)](https://i.sstatic.net/NyouD.jpg)
  
  I've temporarily fixed the error via `general.php` by disabling CSRF Protection (not recommended).
  
  How do I implement CSRF Protection on this form? I've followed [this article](https://craftcms.com/support/csrf-protection), but replacing the name and value fields will surely disable the plugin's functionality?
  
  Should I also implement the method shown [here](https://craftcms.com/support/csrf-protection) for other forms like [Am Forms](https://github.com/am-impact/amforms)?
  
  **Update:**
  There's a pull request on the [plugin git page](https://github.com/aelvan/mailchimp-subscribe-craft/pull/43) regarding this.
  
  **Tags:** form, security, csrf, plugin-amforms, plugin-mailchimpsubscribe
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-09-27. Score: 3 | Accepted answer
  
  Enable CSRF protection in your config again and add `{{ getCsrfInput() }}` right after the `<form>` opening tag on *all* forms on your site, regardless if they are amforms or mailchimp subscribe. I can verify that it won't interfere with the mailchimp plugin as I am currently (and just recently) installed it on a project I'm working on and it works fine.
  
  > **Comments:**
  > **username_0**: Excellent, thank you. I can confirm it's working perfectly.  
  
  ---
  
  