Apple Intelligence is now available on iPhone, iPad, and Mac!

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Invalid CSRF token

When I visit a web site and try to login, I'm getting a message that states, "Invalid CSRF token", and the site won't log me in. I've tried Google and Wikipedia about this and while they give info, that info is way beyond my computer knowledge.


I have determined it seems to be something that has attached itself to my particular input through my Safari app. If I use a different browser, Firefox in this instance, the problem does not happen.


This laptop is a MBP (Retina. 15-inch, Mid 2015), macOS 10.14.4


I also have a MacBook (Retina, 12-inch, Early 2016), macOS10.14.3 that does not have this problem


My next step is to re-install system software but I wanted to get some feedback before I go there.


Does anyone know about this?



MacBook Pro 15", macOS 10.14

Posted on Apr 14, 2019 9:22 AM

Reply
31 replies

Apr 16, 2019 10:48 AM in response to dinhr

Yes, for sure. I cannot tell you without running Detailed system diagnostics and examining your mac/pc built in certificate PKI chain & search for specific execution settings and or the presence of certain xml ini or shortcuts with shellcode built in (a common way to allow user to see normal OS and programs while actually silently executing elevated admin via the system command shell which basically means it is no longer your computer as you are not in control of it, remotely and without your knowledge many files can be deleted, have their metadata altered, and then replaced with files bearing legitimate system program names but containing malicious code or is a for show (think user runs antivirus) programs that go through the motions but intentionally allow all activity due to signature file tampering, process impersonation hi jacking or code injection which uses legitimate Sys Admin Remote Tools to disguise true results via hidden xml JavaScript Json VBs powershell bay cmd sh bash etc files that are hidden in filesystem but when executing a program, Process, Service, daemon, app, or the favorite go to—Internet Browsers which have so many Avenues of compromise due to the prevalence of Dom scripting & refactored minified versions of web page scripts are hosted on third party domains (good intent is to optimize page load time & performance) but due to non first party sources being accessed concurrently and performing operations on your web tab it provides a high potential for exploit especially with evolution of CSS capacity & HTML5-XHTML/XML:XSL.


basically lock down your browser, use private browsing, get an add on that deletes all of Sites cookies and local files including LSO or “zombie-flash” cookies the instant you close a tab. Ensure you block all third party content cookies etc by default and only allow as needed on known sources (example page needs to load video hosted elsewhere in iframe with player). Make sure you have strict system policies regarding single domains with no transferring first party only (ex: Apple.com make sure you only allow traffic or web items to load from Apple.com) this may change browsing experience but it mostly just blocks ads web bugs tracking beacons cookies frames and removes referrer from header or disallows your path (ie visited Macy’s.com no reason google needs to know you came from their when moving on to view TechCrunch.com; use Firefox is my suggestion as you can alter core browser operation to harden inet in about:preferences & use self destruct cookies + uMatrix + ff containers tabs(with any email it syncs fully desktop and iOS just like safari) and is much more secure and controlled. Also use canvas anti Fingerprint so you can maintain security and anonymity while using proxy & vpn. This will

stop web crawlers trackers analytics and annoyances from profiling you- only the direct url if you click a link to url only that page needs previous page info everything before current & next should be erased). Use start page or DuckDuckGo as search engines; they are 100% private 0 logs & start page even allows you to visit the result via a proxy to further disguise your identity. Neither engine tracks keystrokes, searches results including users IP which all cough alphabet cough do. They like others make their money from your data and predicting your behaviors & future trends, remember nothing is truly free u unless it’s a non profit or open source consortium like Mozilla the popular “free” mail services come at the cost of privacy, pay $99 to proton mail for year VPN max tier PGP Crypto Email Services with 10 custom domains 10 users per & 100 aliases a ton of security & organizational convenient mail features VPN the most secure available; they own and operate all infrastructure including Swiss ISP that services within 100 miles of their mountain bunker allowing full data privacy by Swiss privacy laws physically located in ex military bases deep underground mountains in Greenland & Switzerland which are not part o EU or 14 eyes surveillance nations and have strongest privacy laws available & do not recognize US legal requests. By utilizing their secure core feature you first connect to a max secure harden server in Switzerland or Greenland then server closest to your physical location or TOR/P2P If desired. Speeds even with triple Crypto are 60mb Down 45 up via IPhone WiFi. This plus proxy service like squid provides anonymity & security from exploits & black hats & big tech as long as you follow proper privacy etiquette. Its the best way to secure your home from black hats which today is equivalent to what physical locks and alarms were before humanity put our lives on interconnected servers worldwide. Everything of value is digital

Apr 16, 2019 10:49 AM in response to thegil17

. Everything of value is digital; guard it!



answer short: yes restore system files preferably using a Sys image restore disk you made when first booted comp as recovery drives are easily compromised. Or download image on liveusb and get drivers & updated os direct from Apple. You’ll be good to go. Make sure you watch your internet settings and be as secure as possible, more important than locking your front door.

Invalid CSRF token

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.