A possible CSRF attempt was detected. No referer was provided by the server.#

A possible CSRF attempt was detected. No referer was provided by the server.

Getting this message when trying to login to my site manager in Firefox on Mac. Just updated to 1.0.1 today. Seems to be fine at the moment in Safari.

Anyone else experiencing this? What does it mean?

I got this couple hours ago. It went away after couple minutes.

http://en.wikipedia.org/wiki/Cross-site_request_forgery
http://modxcms.com/forums/index.php?topic=36771.0

Thanks. That other thread you pointed me to might help, but I'm not exactly sure how to do what they're explaining. Still hoping for a better explanation.

There was a bug in 1.0.1 where modx didnt recognize turning CSRF off.

To fix, change


to

I've just installed a version of 1.0.2 and the issue is still there.

Which file is it that I need to make that adjustment to?

I just installed 1.0.2 on hostgator for a new project. I've been working on it for a few days with no error message. Today, I started getting this message: A possible CSRF attempt was detected. No referer was provided by the server.

Per another thread I tried this fix:

The only fix was for me to change the line 228 in manager/index.php

from
if (isset($modx->config['validate_referer']) && $modx->config['validate_referer']) {

to
if (isset($modx->config['validate_referer']) && $modx->config['validate_referer'] == '1') {

After deleting: assets/cache/siteCache.idx.php and refreshing the cache in modx manager and on the browser, no effect.

BTW, I saw two versions of the fix one like this: == '1' and one like this == 1. I tried both.

I have 1.0.2 installed on hostgator for another project and have never received this message. Settings appear to be the same. Both have Validate HTTP_REFERER headers? set to yes in the configuration page in the manager.

Not sure what to try next.

Thank you!

If your Web Developer Toolbar is set to disable referrers, you will need to enable sending of referrer info. That's what I had to do to solve this problem.

Other options are detailed here: http://www.belafontecode.com/fix-modx-csrf-error-in-firefox/