WordPress/Elementor: No submit token available. Validation of this form is not possible. + Blocking of a multi-origin request

[css31]

Hi,

I installed mosparo a few months ago on my shared hosting. I then configured 7 projects (all contact form WordPress/Elementor of different websites on different domains). Everything was working fine until I realized a few days ago that only 1 project was still working, all the others were down. The only change I made was to update mosparo.

The mosparo module at the bottom of the form displays:

An error occurred. Please try again.

and after clicking:

No submit token available. Validation of this form is not possible.

The Firefox console indicates :

Blocking of a multi-origin request (Cross-Origin Request): the "Same Origin" policy does not allow the remote resource located at https://mosparo.mydomain.com/api/v1/frontend/request-submit-token to be consulted. Reason: the CORS "Access-Control-Allow-Origin" header is missing. Status code: 200.

Is COR the problem?

The only site still running uses the same settings without any problem.

Thanks for your help

[zepich]

Hi @css31

Thank you very much for your question. I think your problem is related to the Hosts bug fix we had to do in version 1.2. Before version 1.2, every host was allowed to use the mosparo project. However, with version 1.2, this issue is fixed.

For every project, you have to define the hosts on which you want to use the project. For this, you have to define the hosts in the project settings. You can read more about that here: https://documentation.mosparo.io/docs/usage/settings/#hosts

For example, if you have a form on https://example.com/contact/, you must put example.com as the host value in the Hosts setting in mosparo.

Since you have CORS errors after the update, I guess your hosts are not correctly configured.

Are the websites where mosparo is not working anymore correctly configured in the hosts settings?

I'm sorry for the trouble.

Kind regards,

zepich

[css31]

Hi Zepich,

That's it!

In fact for all projects except the one working the hotes was: https://www.example.com

deleting https:// did the job.

Thanks a lot, it was driving me crazy.

Best,

[zepich]

Hi @css31

Fantastic, thank you very much for letting me know!

I can understand that. It's an annoying issue and bug fix, but we had to do it.

Kind regards,

zepich

[css31]

Hi Zepich,

I totally agree with you.

Maybe you could add a explanation close to the host field.

Please indicate all the hosts that this project will include (e.g. for https://www.example.com type www.example.com).

Thanks again mosparo is a great tool !

By the way, I'm working on the French translation. ;-)

[zepich]

Thank you very much!

[zepich]

Maybe you could add a explanation close to the host field.

Please indicate all the hosts that this project will include (e.g. for https://www.example.com/ type www.example.com).

I will try to add a simple validation for these hosts fields and check the origin for things like http(s):// and / in general. I think that would make it easier to configure the setting.

By the way, I'm working on the French translation. ;-)

I saw that! Thank you very much for your work!

[zepich]

The new version, v1.2.3, contains a better validation of the host field values, so it should now be easily understandable if someone enters the host with the protocol (https://), the path, or anything else that is not allowed.