I can get CSRF token to be generated on particular route by putting _crsf_token in a routing file, but on visiting that route , I keep getting an Access Denied error.

Removing CSRF token line from the routing file gives me back access to the access instantly.

What could be possibly wrong?

I have tried to make sense of Menu Callback and CSRF but don't think it is related to my problem.

  • You should show your route definition, or users cannot point out to any mistakes in your route definition.
    – apaderno
    May 17, 2016 at 4:57
  • 1
    Also the code where you generate the link/path for the route. drupal.org/node/2575519 was fixed less than 24h ago and could be the problem.
    – Berdir
    May 17, 2016 at 8:27

1 Answer 1


@Berdir Applying patch #14 on this page has solved the problem! Thank you very much!

Twig template variables containing result of Drupal::url() and Drupal:l:() don't bubble up their cacheability and attachment metadata (e.g. token placeholder)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.