PrestaShop 9 errors
The CSRF token is invalid. Please try to resubmit the form: saving products in the PrestaShop back office
Saving a product or another large form in the back office fails with this message. After a move to new hosting or a PHP change, the most common cause is max_input_vars. PHP cuts the form short, and the token is its last field.
- The error
The CSRF token is invalid. Please try to resubmit the form.- Appears
- Saving products and other large back office forms (1.7 – 9.x)
- Usually found in
- PHP settings (max_input_vars, sessions)
What happened
Every back office form built with Symfony sends a hidden _token field. The server compares it with the token kept in the PHP session. If the field does not arrive, or the session is lost, saving stops with this message and nothing is saved.
The cause we see most often is max_input_vars. PHP accepts at most that many fields per request (1000 by default) and silently drops the rest, leaving only a warning in the log. In the PrestaShop 9.2 product form, product[_token] is the last field. So when the form has more fields than the limit, the token is the first thing to go.
We tested it on our 9.2 test store. With max_input_vars = 50, saving a product returned exactly this message. With the limit restored, the same save worked (Successful update).
It typically starts after a move to new hosting or a PHP version change: the new server comes with the default 1000, while the old one had a higher value. Forms grow with every language, feature and customization field, and with modules that add their own fields to the product page.
The fix
Raise the limit, for example to 10000:
max_input_vars = 10000
Put it where your PHP reads it: php.ini, the PHP settings in the hosting panel, .user.ini with PHP-FPM, or php_value max_input_vars 10000 in .htaccess with Apache mod_php. Then check in phpinfo that the new value is active.
To see whether a form is near the limit, open the product page, open the browser console (F12) and run:
[...new FormData(document.querySelector('form[name=product]')).keys()].length
If the number is close to max_input_vars or above it, you have found the cause.
Other causes of the same message
- The session is not saved. PrestaShop 9 uses PHP's own sessions, so
session.save_pathmust exist, be writable and not full. If it is not, every token check fails. - The back office is opened at different addresses. The session cookie belongs to one host. Always use the same address, with or without
wwwand always on https. - A JavaScript error stops the form scripts. This happens, for example, when PrestaShop runs on a PHP version it does not support, like 1.7.6 on PHP 7.4. Check the browser console for red errors, and the PrestaShop and PHP versions table.