[NOOB] CSRF check failed. [SOLVED] => ReInstall

[MarieSophieSG]

Previous:
> On all 5 clients all at the same time ?
No, this web dev tools is useful to delete specific cookies and to analyse the browser-server conversation. Just the one machine being used to diagnose is sufficient.

Sorry, my meaning was about the suggestion that it could be a client-side problem rather than central OPNsense, my reaction was: On all five client at the same time ? (if it was a coockie or browser problem)

Anyway, as I SSH'd reboot, which was refused, and even opt. 5 OFF, so I hard switched it off and I just took the box out of its shelf, went back to the wokbench, screen+keyboard => reinstall

I saw many weird messages at first, and a long time hanging, clamAV was still installed and running (despite being removed from the GUI), etc .. so that convinced me to do a fresh reinstall

Much quicker than the first, on the user side :-p

Now all access back up and running ... will do a backup right away in this "stock running" state, and then I will resume my tentative to have all laptops accessing both NAS as by default, LANs don't communicate with each others

[MarieSophieSG]

While going through all set-up, I saw:

Code Select Expand

Enable HTTP Strict Transport Security
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking.

And

Code Select Expand

Disable HTTP_REFERER enforcement check
When this is unchecked, access to the web GUI is protected against HTTP_REFERER redirection attempts. Check this box to disable this protection if you find that it interferes with web GUI access in certain corner cases such as using external scripts to interact with this system. More information on HTTP_REFERER is available from Wikipedia.


Which I may have triggered in the previous config, not sure but it rings me some bell, I think I did the first HSTS ...
Could that be the reason ?

[cookiemonster]

yes, I was going to suggest to change as a test that but it was a chicken and egg situation.
Glad you're fine again.

[odz]

I have the same problem. Latest opnsense on hyper-v installation and it crash all. When try log in to admin panel get:
CSRF check failed. Your form session may have expired, or you may not have cookies enabled.
I have old version opnsense on second VM and never getting this error...
Any idea?

[franco]

Your browser opens a cached page with the wrong CSRF token. Just flush your cache.


Cheers,
Franco