[5.x]: asyncCsrfInput true or false negatively impacts page speed
Open
@timkelty is already working on this.
Since Nov 11, 2025.
bug
- Dominant language
- PHP
- Stars
- 3.6k
- Forks
- 705
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 134
Description
What happened?
Description
- Setting asyncCsrfInput true - Creates an extra network request to the network dependency tree on page load which negatively impacts the LCP Core Web Vitals metric
- Setting asyncCsrfInput false - Forces a no-cache server response header which forces a static caching layer to be bypassed, negatively impacting TTFB.
Steps to reproduce
- set either setting
- run a pagespeeed/lighthouse test
Expected behavior
- For a craftcms website to not to be negatively impacted by a feature we cannot control
- asyncCsrfInput false should instead never set a nocache header - then we can be in control of when it should fetch a CSRF, e.g. when a form is "in view"
Actual behavior
- No matter what setting is set, it negatively impacts performance
Craft CMS version
5
PHP version
8
Operating system and version
No response
Database type and version
No response
Image driver and version
No response
Installed plugins and versions
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.