PHP 8 “This request was aborted because it appears to be forged” on login

[DrQuincy]

Hi,

I am doing a site that does a fair bit of number crunching and decided to try PHP 8 as I read it was a fair bit faster.

The front-end works fine but when I log in to /processwire/ I get:

Quote

ProcessWire: ProcessLogin: This request was aborted because it appears to be forged.

When switching back to PHP 7.4 it works as expected. I did also try it on a computer that had never accessed the back-end before and got the same error (though in hindsight I wonder if I should've cleared the cookies first).

Does PW definitely work on PHP 8? I am using 3.0.184. If so, I wonder if it is a module that's the problem — or maybe the CSRF token needed clearing. I know you can disable CSRF but I am reluctant to do that. I have session fingerprinting disabled also.

I just thought I'd check first to see if the core is fine to run on PHP 8. Searching the forums you find threads of people saying don't use v8 yet — but they're all about a year old.

Thanks.

[Robin S]

11 hours ago, DrQuincy said:

When switching back to PHP 7.4 it works as expected.

I suggest checking that the PHP extensions and settings are the same between your PHP 7.4 instance and your PHP 8 instance. For example, someone posted recently with the same issue and found that the problem was due to unexpected settings in php.ini

 

[DrQuincy]

Thanks, they are the same settings.

When I get the chance I will try on a browser with everything cleared and if that doesn't work I'll try disabling some modules. I do have the forgotten password and email new user modules installed so maybe it's them.

I'll post if I find a fix!

[MrSnoozles]

Fix (for me): I deleted all cookies and the sessions database table.

Maybe deleting all cookies is sufficient, but as I tried both together I can't say for sure. Another solution I saw here is that it's been a permission error and site/config.php could not be read.