Skip to main content
deleted 511 characters in body
Source Link
David Thomas
  • 21.9k
  • 2
  • 33
  • 68

The error is related to form CSRF protection, the error message comes from core FormValidator.phpform validation.

if (isset($form['#token'])) {
  if (!$this->csrfToken->validate($form_state->getValue('form_token'), $form['#token']) || $form_state->hasInvalidToken()) {
    $this->setInvalidTokenError($form_state);

    // Stop here and don't run any further validation handlers, because they
    // could invoke non-safe operations which opens the door for CSRF
    // vulnerabilities.
    $this->finalizeValidation($form, $form_state, $form_id);
    return;
  }
}

To avoid thatthe error, it's possible to remove that CSRF token validation check in hook_form_alter e.g:

function my_module_form_alter(&$form, &$form_state, $id) {
  if (strpos($id, 'webform') === 0) {
    // Bypass per user CSRF token check and allow cache.
    unset($form['#token']);
  }
}

The caveat is, the form will no longer have default CSRF protection.

Alternatively, you might be able to detect the user has logged in (e.g custom local storage set event) and reload the original page to refresh it as is.

The error is related to form CSRF protection, the error message comes from core FormValidator.php

if (isset($form['#token'])) {
  if (!$this->csrfToken->validate($form_state->getValue('form_token'), $form['#token']) || $form_state->hasInvalidToken()) {
    $this->setInvalidTokenError($form_state);

    // Stop here and don't run any further validation handlers, because they
    // could invoke non-safe operations which opens the door for CSRF
    // vulnerabilities.
    $this->finalizeValidation($form, $form_state, $form_id);
    return;
  }
}

To avoid that error, it's possible to remove that CSRF token validation check in hook_form_alter e.g:

function my_module_form_alter(&$form, &$form_state, $id) {
  if (strpos($id, 'webform') === 0) {
    // Bypass per user CSRF token check and allow cache.
    unset($form['#token']);
  }
}

The caveat is, the form will no longer have default CSRF protection.

Alternatively, you might be able to detect the user has logged in (e.g custom local storage set event) and reload the original page to refresh it as is.

The error is related to form CSRF protection, the error message comes from core form validation.

To avoid the error, it's possible to remove that CSRF token validation check in hook_form_alter e.g:

function my_module_form_alter(&$form, &$form_state, $id) {
  if (strpos($id, 'webform') === 0) {
    // Bypass per user CSRF token check and allow cache.
    unset($form['#token']);
  }
}

The caveat is, the form will no longer have default CSRF protection.

Alternatively, you might be able to detect the user has logged in (e.g custom local storage set event) and reload the original page to refresh it as is.

Source Link
David Thomas
  • 21.9k
  • 2
  • 33
  • 68

The error is related to form CSRF protection, the error message comes from core FormValidator.php

if (isset($form['#token'])) {
  if (!$this->csrfToken->validate($form_state->getValue('form_token'), $form['#token']) || $form_state->hasInvalidToken()) {
    $this->setInvalidTokenError($form_state);

    // Stop here and don't run any further validation handlers, because they
    // could invoke non-safe operations which opens the door for CSRF
    // vulnerabilities.
    $this->finalizeValidation($form, $form_state, $form_id);
    return;
  }
}

To avoid that error, it's possible to remove that CSRF token validation check in hook_form_alter e.g:

function my_module_form_alter(&$form, &$form_state, $id) {
  if (strpos($id, 'webform') === 0) {
    // Bypass per user CSRF token check and allow cache.
    unset($form['#token']);
  }
}

The caveat is, the form will no longer have default CSRF protection.

Alternatively, you might be able to detect the user has logged in (e.g custom local storage set event) and reload the original page to refresh it as is.