Problem/Motivation
On multilingual sites with language prefixes used, the ajax requests with CSRF tokens are failing with this error response:
{"status":"error","message":"Invalid CSRF token.","ticket_id":"WA-692714294fa77"}
The error log shows these details:
CSRF Fail: Token=kQfj28QjLczNWbl82W6zhJUI51yu_O521mRBYbwB064, Path=de/wa/register/options, Valid1=NO, Valid2=NO (Ticket ID: WA-692714294fa77)
So, it called the path de/wa/register/options. If I manually correct this to not use the language prefix, it works. So it should call the path wa/register/options instead.
Issue fork wa-3560115
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3560115-invalid-csrf-token
changes, plain diff MR !5
Comments
Comment #3
jurgenhaasThe approach in the MR is to use the same paths as used to generate the tokens, that works in my tests.
Comment #5
mingsongGood catch.
According to my manual test and the new PHPUnit test, I believe this issue is patched with Beta4.
Thanks.