CSRF Issue in iOS / Mobile Safari — unable to verify your data submission
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.6k
- Forks
- 705
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 134
Description
Description
We get quite a few "unable to verify your data submission" CSRF errors on our site (50-100 a day). We've got around ~7k users logging in and doing things. Almost all of these happen on Mobile Safari. We even switched from CSRF cookies to session with no luck.
Note that it doesn't happen for every mobile safari user — but it happens enough that it's an issue.
Here is a screenshot of the error in our Sentry account:
Steps to reproduce
- Have a site with a lot of users/forms.
- 50-100 times a day you'll get "unable to verify your data submission" errors from users using Mobile Safari.
Additional info
- Craft version: Happens on 3.6 through 3.7.4 — probably before 3.6 as well.
- PHP version: 7.4.15
- Database driver & version: MySQL 5.5.5
- Plugins & versions: Most relevant would be Snaptcha — I assume it's an issue with CSRF + Mobile Safari though.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the CSRF handling for Craft 3.6–3.7.4 and comparing cookie- and session-based validation under Mobile Safari. Use the reported Sentry error and the stated 50–100 daily failures as the reproduction signal; done means identifying a reproducible cause and preventing the verification failures without weakening CSRF protection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mysql, php
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100