# CsrfToken mismatch with proper token?

**URL:** <https://discourse.cakephp.org/t/csrftoken-mismatch-with-proper-token/7276>\
**Category:** Need Help\
**Created:** [February 13, 2020, 10:14pm UTC](https://discourse.cakephp.org/t/csrftoken-mismatch-with-proper-token/7276 "2020-02-13T22:14:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![FinlayDaG33k](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/finlaydag33k/32/1049_2.png) [@FinlayDaG33k](https://discourse.cakephp.org/u/FinlayDaG33k)\
**Post date:** [February 13, 2020, 10:14pm UTC](https://discourse.cakephp.org/t/csrftoken-mismatch-with-proper-token/7276/1 "2020-02-13T22:14:53Z")

</div>

Hii there,

I’m trying to get my app to submit something with XHR to an API my app exposes _through a plugin_.  
Everything shows up fine in my request but I still get a token mismatch.  
I’ve looked at a form on my website as well to make sure the token lines up with what said form would send and it does.

 ![](https://i.imgur.com/6sKLZZj.png)  
 ![](https://i.imgur.com/EXVkrH2.png)

However, somehow, the form itself can send it just fine but my XHR gets a CsrfToken mismatch…  
I can’t tell it to “not use csrf” here either because it just ignores that (and I don’t want to bother the user of this plugin with manually adding it to the whitelist in his/her project).

---

<div class="post-metadata">

**Author:** ![Graziel](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Graziel](https://discourse.cakephp.org/u/Graziel)\
**Post date:** [February 14, 2020, 9:00am UTC](https://discourse.cakephp.org/t/csrftoken-mismatch-with-proper-token/7276/2 "2020-02-14T09:00:49Z")

</div>

how are you sending XHR request? show code, i dont see `_csrfToken` in `POST Data` in your screenshot

---

<div class="post-metadata">

**Author:** ![FinlayDaG33k](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/finlaydag33k/32/1049_2.png) [@FinlayDaG33k](https://discourse.cakephp.org/u/FinlayDaG33k)\
**Post date:** [February 14, 2020, 11:37am UTC](https://discourse.cakephp.org/t/csrftoken-mismatch-with-proper-token/7276/3 "2020-02-14T11:37:33Z")

</div>

It’s in the `Cookie` section.  
(highlighted in the first screenshot).

---

<div class="post-metadata">

**Author:** ![Graziel](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Graziel](https://discourse.cakephp.org/u/Graziel)\
**Post date:** [February 14, 2020, 11:56am UTC](https://discourse.cakephp.org/t/csrftoken-mismatch-with-proper-token/7276/4 "2020-02-14T11:56:41Z")

</div>

you need to send both cookie and field in post data (or header)

> <https://github.com/cakephp/cakephp/blob/bd8648bd6ff47ba47d00c93bd91d863885eb1960/src/Http/Middleware/CsrfProtectionMiddleware.php#L231>

---

<div class="post-metadata">

**Author:** ![FinlayDaG33k](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/finlaydag33k/32/1049_2.png) [@FinlayDaG33k](https://discourse.cakephp.org/u/FinlayDaG33k)\
**Post date:** [February 14, 2020, 12:19pm UTC](https://discourse.cakephp.org/t/csrftoken-mismatch-with-proper-token/7276/5 "2020-02-14T12:19:07Z")

</div>

Oh, alright, I didn’t know that.  
Thanks 🙂

UPDATE:  
Seems to have worked 🙂  
Now getting a “Missing Controller” error, which is more obvious to fix 🙂