Cannot post comment or reply - 400 error

[Terry Upton]

Description

Hi Josh
I have run updated recently, so I am not sure which exact update this occurred in, but I updated as follows:. from 1.3.10 -> 1.5.4 and then 1.5.4 > 1.5.6.

Since then we are not able to posr comments or replies.
Getting this 400 error:

comments.js?v=1591190162:1 POST https://thembrsite.loc/index.php?p=actions/comments/comments/save 400
ajax @ comments.js?v=1591190162:1
(anonymous) @ comments.js?v=1591190162:1
(anonymous) @ comments.js?v=1591190162:1
Promise.then (async)
then @ recaptcha__en.js:217
checkCaptcha @ comments.js?v=1591190162:1
postForm @ comments.js?v=1591190162:1
onSubmit @ comments.js?v=1591190162:1

This is the same on both local dev and live server.
I updated again today to 1.6 but this still remains broken.

I am using the native templates/code as follows:

{% if entry.commentOptions.commentEnabled == 1 %}
  <div class="p-6 mb-6 leading-normal bg-grey-lighter text-sm font-semibold my-12">
    <h2 class="mb-0 lg:p-4 flex flex-wrap items-center text-2xl leading-loose" id="Comments">
      {{ svg('@icons/chat.svg', class="w-10 h-10 flex-shrink-0 fill-current mr-2") }}
      Comments
    </h2>
    {{ craft.comments.render(entry.id) }}
  </div>
{% endif %}

[Josh Crawford]

Just to confirm, you're not using any template overrides, and you have the default CSS and JS enabled? This error points to the CSRF token missing on requests, which the default templates, and the default JS include.

Could you inspect your network tab (in Chrome) and send through a screenshot, or text of the headers being sent? Similar to:

[Terry Upton]

Hi Josh. No overrides at all. Just the native code as above.
Hopefully these screenshots help. But let me know if you need anything more specific. Or ping me over on Discord.

[Terry Upton]

I think it might be an issue with the Captcha. But I have not changed anything on this. But when I disable this it seems to allow the comment to post.

[Josh Crawford]

Aha - you're totally right, recaptcha was the issue. Fixed in 1.6.1