Open forms cannot be saved after "Relogin" (Security Token errors)
|Priority:||Should have||Due date:|
|Assignee:||Steffen Kamper||% Done:||
If you have an open form (e.g. editing a content element) and you leave your browser unattended until "session expires", you can relogin with the popup window (or the JS overlay).
After this relogin, if you try to save your work, you will get security token errors.
The CSRF protection token is in a hidden field, and if the session has expired in the meantime, the session data (including the original tokens) are gone, so when saving that form after the relogin won't be able to validate them. Different potential solutions:
a) go through the DOM and manipulate all hidden fields with a token and change them with a new valid token. doable, but will require some work
b) allow "one save without token check" right after the relogin, so that this form can be finally saved, and after that things continue as usual.
(issue imported from #M17383)
|related to Core - Bug #24755: Re: issue #24715 - problem still exists in 4.5.0rc1||Closed||2011-01-23|
|related to Core - Bug #24671: Protect C(R)UD actions against CSRF||Closed||2011-01-20|
|duplicated by Core - Bug #24870: Regression: The ExtDirect token needs to be regenerated a...||Closed||2011-01-28|
Updated by Peter Niederlag over 2 years ago
I am 99% percent sure the issue (#24755) shows up as well without any open form/data:
login.... wait ... expire ... relogin -> error messages
Updated by Ernesto Baschny over 2 years ago
Yes, peter, but these are most probably the ExtDirect errors, see #24870.
If there is yet another category of errors, please open another issue for this ;)