"The security token did not match." upon login on frontend after upgrading to 3.7

[faramarz58]

I recently upgraded to 3.7, also upgraded PHP to 7 and I remember the site and the login was okay after the upgrade but since yesterday this warning pops up when a user tries to login on frontend:

Warning
The security token did not match. The request was aborted to prevent any security breach. Please try again.

Why am I getting this message and why the login fails? How to troubleshoot? I can login to Admin and everything in admin looks fine.

In the error_log in the root, I see these PHP warnings:

[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/plugin/helper.php on line 102
[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/menu/site.php on line 118
[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/menu/menu.php on line 76
[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/menu/menu.php on line 259
[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/menu/menu.php on line 259
[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/menu/menu.php on line 259
[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/menu/menu.php on line 259
[10-May-2017] PHP Warning: Invalid argument supplied for foreach() in /libraries/cms/plugin/helper.php on line 102

Are these related to the security token issue?

[itoctopus]

I would say this is likely caused by one of your system plugins. Try disabling your non-core system plugins one by one until you find the culprit.

[faramarz58]

Will do. On the side note, I am not getting the login error when I try logging in via http://mydomain.com/index.php. It is only happening on http://mydomain.com/.

Also, this might be a different issue, I am using Protostar as my default template, I switched the style to Fluid layout under Advanced tab, now fluid layout is being shown on http://mydomain.com/index.php and I can login but not on http://mydomain.com/. I am still seeing the Static layout on mydomain.com and the login does not work.

[candidosa2]

Well I'm having the same mistake
The only plugin I activated was System - Page Cache

Let try now to fixes

[rowdyred94]

I'm seeing the same thing, and the problem seems to have messed up our CiviCRM instance, too. Our contribution page pre-populates one particular user for all visitors.

[weredigi]

I am having the exact same issue. BUT if I log in again right away it does work.
Guess we will have to tell those trying to login to do it twice ... sort silly

This sort fo bug goes way back in the forums is there actually anyone actively trying to find a fix to keep this working? This is something that should not be affected by plugins or anything else added to the site. I'm not an advanced coder but there must be a way to not have this be affected by additional add-ons of any sort.

[lupoll86]

This has not been fixed so far.

It does happens when the plugin "System - Page Cache" is enabled and when we try to login on the front end of Joomla.

It does let us login on the second attempt but it comes back when we log out and try to login again.

I will try to see if I found a solution but so far the only one is by disabling the plugin.

I will update here if I fix it.

[leolam]

https://issues.joomla.org/tracker/joomla-cms/12030 We know the issue but not yet addressed so do NOT activate the page cache plugin (!)

Leo

[steveorg]

https://issues.joomla.org/tracker/joomla-cms/12030 We know the issue but not yet addressed so do NOT activate the page cache plugin (!)

Leo

If I understand correctly, the request seems to have been denied. Too bad because I still have the issue with Joomla 3.8.5.

[sozzled]

@steveorg: The tracker item referred to by @leolam was created 1½ years ago (back in the days of J! 3.6). While it appears that the issue hasn't been formally addressed for J! 3.6+ (and you've discovered your own workaround, anyway) we need to be careful about addressing these matters in multiple places across the forum.

As a general rule plugins, that are disabled by default within a standard Joomla installation, should only be enabled when there's a need to enable them and when people understand the consequences of enabling them. The System - Page Cache plugin is not generally required.

The article (https://www.energizethemes.com/blog/joo ... -Work.html) helps to understand its purpose:

Page caching (System page cache plugin)

Page caching (system cache plug-in) basically takes a snapshot of the whole page including the templates, components and modules.

This option gives you no control over the module cache settings or over the progressive or conservative options included in the global configuration settings.

If you have a website with static content and only publish an article now and again then this is a good option for you. As and when you publish new articles or make updates at Your website you can always quickly clear the cache.

So that's why it exists and the situations where it may be useful. The other cache settings in the Global Configuation do not rely on this plugin to be enabled.

Summary: Enabling the System - Page Cache plugin may cause other unintended consequences (for example "The security token did not match" message) and, if that's the case, then the remedy is to disable the plugin. Caching, in general, can cause other unintended consequences, too but there are thousands of articles and forum topics that discuss those things.

[fancyhome]

it is the system-encyript plugin causing this error. I disabled this plugin and login works perfect now...