# CSRF-Token is invalid  path "/backend/Login?file=app&no-cache=1526361757

**URL:** <https://forum.shopware.com/t/csrf-token-is-invalid-path-backend-login-file-app-no-cache-1526361757/52961>\
**Category:** Allgemein\
**Created:** [17. Mai 2018 um 08:59 UTC](https://forum.shopware.com/t/csrf-token-is-invalid-path-backend-login-file-app-no-cache-1526361757/52961 "2018-05-17T08:59:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sascha81](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@sascha81](https://forum.shopware.com/u/sascha81)\
**Post date:** [17. Mai 2018 um 08:59 UTC](https://forum.shopware.com/t/csrf-token-is-invalid-path-backend-login-file-app-no-cache-1526361757/52961/1 "2018-05-17T08:59:25Z")

</div>

Ich bekommen schon wieder einige E-Mails am Tag, dabei es ist alles Aktualisiert…

&nbsp;

Message:

```
 The provided CSRF-Token is invalid. If you're sure that the request to path "/backend/Login?file=app&no-cache=1526361757" should be valid, the called controller action needs to be whitelisted using the CSRFWhitelistAware interface.

```

Time:

```
 2018-05-17T09:17:44.688952+0200

```

Channel:

```
 core

```

request:

```
 { "uri": "/backend/Login?file=app&no-cache=1526361757", "method": "GET", "query": { "file": "app", "no-cache": "1526361757", "module": "backend", "controller": "Login", "action": "index" }, "post": [] }

```

shop:

```
 No shop data available

```

session:

```
 No session data available

 Shopware\Components\CSRFTokenValidationException: The provided CSRF-Token is invalid. If you're sure that the request to path "/backend/Login?file=app&no-cache=1526361757" should be valid, the called controller action needs to be whitelisted using the CSRFWhitelistAware interface. in /www/htdocs/w017d338//engine/Shopware/Components/CSRFTokenValidator.php:109 Stack trace: #0 /www/htdocs/w017d338/engine/Library/Enlight/Event/Handler/Default.php(91): Shopware\Components\CSRFTokenValidator-\>checkBackendTokenValidation(Object(Enlight\_Controller\_ActionEventArgs)) #1 /www/htdocs/w017d338//engine/Library/Enlight/Event/EventManager.php(220): Enlight\_Event\_Handler\_Default-\>execute(Object(Enlight\_Controller\_ActionEventArgs)) #2 /www/htdocs/w017d338//engine/Library/Enlight/Controller/Action.php(176): Enlight\_Event\_EventManager-\>notify('Enlight\_Control...', Object(Enlight\_Controller\_ActionEventArgs)) #3 /www/htdocs/w017d338//engine/Library/Enlight/Controller/Dispatcher/Default.php(549): Enlight\_Controller\_Action-\>dispatch('indexAction') #4 /www/htdocs/w017d338//engine/Library/Enlight/Controller/Front.php(222): Enlight\_Controller\_Dispatcher\_Default-\>dispatch(Object(Enlight\_Controller\_Request\_RequestHttp), Object(Enlight\_Controller\_Response\_ResponseHttp)) #5 /www/htdocs/w017d338//engine/Shopware/Kernel.php(215): Enlight\_Controller\_Front-\>dispatch() #6 /www/htdocs/w017d338//vendor/symfony/http-kernel/HttpCache/HttpCache.php(486): Shopware\Kernel-\>handle(Object(Symfony\Component\HttpFoundation\Request), 1, true) #7 /www/htdocs/w017d338//engine/Shopware/Components/HttpCache/AppCache.php(268): Symfony\Component\HttpKernel\HttpCache\HttpCache-\>forward(Object(Symfony\Component\HttpFoundation\Request), true, NULL) #8 /www/htdocs/w017d338//vendor/symfony/http-kernel/HttpCache/HttpCache.php(253): Shopware\Components\HttpCache\AppCache-\>forward(Object(Symfony\Component\HttpFoundation\Request), true) #9 /www/htdocs/w017d338//engine/Shopware/Components/HttpCache/AppCache.php(105): Symfony\Component\HttpKernel\HttpCache\HttpCache-\>pass(Object(Symfony\Component\HttpFoundation\Request), true) #10 /www/htdocs/w017d338//shopware.php(122): Shopware\Components\HttpCache\AppCache-\>handle(Object(Symfony\Component\HttpFoundation\Request)) #11 {main}
```

---

<div class="post-metadata">

**Author:** ![vanwittlaer](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.shopware.com/vanwittlaer/32/8499_2.png) [@vanwittlaer](https://forum.shopware.com/u/vanwittlaer)\
**Post date:** [17. Mai 2018 um 09:12 UTC](https://forum.shopware.com/t/csrf-token-is-invalid-path-backend-login-file-app-no-cache-1526361757/52961/2 "2018-05-17T09:12:10Z")

</div>

Das ist eben kein gültiger Path, sieht nach Hack aus. Ich hab die E-Mail-Notifications bei unseren Kunden abgestellt wg. dem Overflow, checke stattdessen regelmäßig mal die Logfiles.

Happy selling,

Geert

---

<div class="post-metadata">

**Author:** ![Freddy](https://avatars.discourse-cdn.com/v4/letter/f/3d9bf3/32.png) [@Freddy](https://forum.shopware.com/u/Freddy)\
**Post date:** [24. Oktober 2018 um 06:04 UTC](https://forum.shopware.com/t/csrf-token-is-invalid-path-backend-login-file-app-no-cache-1526361757/52961/3 "2018-10-24T06:04:13Z")

</div>

Bekomme auch diesen Fehler. Gibt es schon eine Lösung?

---

<div class="post-metadata">

**Author:** ![mmayer](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mmayer](https://forum.shopware.com/u/mmayer)\
**Post date:** [13. Februar 2019 um 13:28 UTC](https://forum.shopware.com/t/csrf-token-is-invalid-path-backend-login-file-app-no-cache-1526361757/52961/4 "2019-02-13T13:28:33Z")

</div>

es ist ansich ein „gültiger Pfad“ den der Browser lädt beim Backendlogin. Kommt ein Crawler vorbei der wegen seinem user-agent keine Session bekommt, kann kein gültiges CSRF token generiert werden (wenn ich das richtig verstehe) - so entsteht die Meldung. Es ist im Prinzip ein non-issue.

Surft man mit normalen user-agent und hat den Fehler, hat PHP Probleme sessions zu speichern/abzurufen, sei es in der DB, im Dateisystem oder in einem Redis.