The error is related to form CSRF protection, the error message comes from core FormValidator.php
form validation.
if (isset($form['#token'])) {
if (!$this->csrfToken->validate($form_state->getValue('form_token'), $form['#token']) || $form_state->hasInvalidToken()) {
$this->setInvalidTokenError($form_state);
// Stop here and don't run any further validation handlers, because they
// could invoke non-safe operations which opens the door for CSRF
// vulnerabilities.
$this->finalizeValidation($form, $form_state, $form_id);
return;
}
}
To avoid thatthe error, it's possible to remove that CSRF token validation check in hook_form_alter
e.g:
function my_module_form_alter(&$form, &$form_state, $id) {
if (strpos($id, 'webform') === 0) {
// Bypass per user CSRF token check and allow cache.
unset($form['#token']);
}
}
The caveat is, the form will no longer have default CSRF protection.
Alternatively, you might be able to detect the user has logged in (e.g custom local storage set event) and reload the original page to refresh it as is.