# Keep getting the error “CSRF token mismatch”

**URL:** <https://discourse.cakephp.org/t/keep-getting-the-error-csrf-token-mismatch/4793>\
**Category:** Uncategorized\
**Created:** [August 23, 2018, 9:27pm UTC](https://discourse.cakephp.org/t/keep-getting-the-error-csrf-token-mismatch/4793 "2018-08-23T21:27:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fatcatcs](https://avatars.discourse-cdn.com/v4/letter/f/3da27b/32.png) [@fatcatcs](https://discourse.cakephp.org/u/fatcatcs)\
**Post date:** [August 23, 2018, 9:27pm UTC](https://discourse.cakephp.org/t/keep-getting-the-error-csrf-token-mismatch/4793/1 "2018-08-23T21:27:30Z")

</div>

I think this is a serious problem. From version 3.6.7, we keep getting the error “CSRF token mismatch”. We don’t load the csrf component. We don’t need it for restful api. Who can tell me how to disable csrf check?

---

<div class="post-metadata">

**Author:** ![rrd](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/rrd/32/113_2.png) [@rrd](https://discourse.cakephp.org/u/rrd)\
**Post date:** [August 24, 2018, 8:52am UTC](https://discourse.cakephp.org/t/keep-getting-the-error-csrf-token-mismatch/4793/2 "2018-08-24T08:52:48Z")

</div>

You should not get the error if the component is not loaded. Are you sure it is not loaded in `AppController.php` or in any other controllers?

Are you sure in the view or in your javascript the token is not set manually?

---

<div class="post-metadata">

**Author:** ![fatcatcs](https://avatars.discourse-cdn.com/v4/letter/f/3da27b/32.png) [@fatcatcs](https://discourse.cakephp.org/u/fatcatcs)\
**Post date:** [August 25, 2018, 11:41pm UTC](https://discourse.cakephp.org/t/keep-getting-the-error-csrf-token-mismatch/4793/3 "2018-08-25T23:41:39Z")

</div>

I am sure the component is not loaded. I am developing restful apis. CSRF is unuseful. This problem only happens from version 3.6.7 to 3.6.10.

---

<div class="post-metadata">

**Author:** ![Graziel](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Graziel](https://discourse.cakephp.org/u/Graziel)\
**Post date:** [August 26, 2018, 5:45am UTC](https://discourse.cakephp.org/t/keep-getting-the-error-csrf-token-mismatch/4793/4 "2018-08-26T05:45:13Z")

</div>

maybe you updated Application.php from skeleton app?

> <https://github.com/cakephp/app/blob/master/src/Application.php#L85>

---

<div class="post-metadata">

**Author:** ![fatcatcs](https://avatars.discourse-cdn.com/v4/letter/f/3da27b/32.png) [@fatcatcs](https://discourse.cakephp.org/u/fatcatcs)\
**Post date:** [August 26, 2018, 4:27pm UTC](https://discourse.cakephp.org/t/keep-getting-the-error-csrf-token-mismatch/4793/5 "2018-08-26T16:27:07Z")

</div>

oh really! Thank you a lot!