How to avoid "The form has become outdated" after login in separate tab

Question

I've read this and this and I can't see how to apply that to my situation, so asking another question.

1. not-logged in user visits a page with a form on it.
2. User opens a new tab and logs in.
3. User switches back to their first tab and tries to submit the form.
4. Gets the outdated error.

How can I accept the anonymous form submissions once logged in?

In my application it's quite possible that the user has quite a few pages open in different tabs before they log in.

Answer 1

The error is related to form CSRF protection, the error message comes from core form validation.

To avoid the error, it's possible to remove that CSRF token validation check in hook_form_alter e.g:

function my_module_form_alter(&$form, &$form_state, $id) {
  if (strpos($id, 'webform') === 0) {
    // Bypass per user CSRF token check and allow cache.
    unset($form['#token']);
  }
}

The caveat is, the form will no longer have default CSRF protection.

Alternatively, you might be able to detect the user has logged in (e.g custom local storage set event) and reload the original page to refresh it as is.

Answer 2

You're getting the error because the form is outdated - the form was created for a "different" user. Drupal's request-forgery protection is there for a reason.

Many sites have this "problem" and the best way IMO to deal with it is for the site to take the submitted form (during validate) and re-present it with existing user-visible values filled in (but obvs. new form tokens etc).

It is then clear to the user that the form has been refreshed and they get a chance to try to submit as themselves.

I expect, though haven't tried, that the refresh action can be achieved using a form validate hook that you ensure is run first, and if it detects the form token is not valid it creates a redirect back to the form URL on the spot.

Alternatively, educate your users that filling forms in anonymously is not wise!