CSRF token is not varying in Ajax callback while submitting form

Question

I have a form with ajax callback as following , on each submit token is not varying , it remains constant for all submit .

wall.routing.yml

wall.commentform:
  path: '/commentform'
  defaults:
    _title: 'Comment form'
    _form: '\Drupal\wall\Form\WallCommentPost'
  requirements:
    _permission: 'access content'
    _csrf_token: 'TRUE'

In from as following

WallCommentPost.php

$ajax = [
  'callback' => [$this, '_wall_comment_ajax_form_post'],
  'wrapper' => 'field-type-replace-comment',
  'event' => 'click',
  'progress' => array(
    'type' => 'throbber',
    'message' => '',
  )
];

$form['wall_submit'] = [
  '#type' => 'submit',
  '#value' => 'Submit',
  '#ajax' => $ajax,
  '#prefix' => '<div class="col-12 p-1 d-flex justify-content-between"><div class="file_name_insert file_name_insert_data-' . $nid . ' pl-4 text-truncate"></div>',
  '#suffix' => '</div>',
  '#attributes' => array(
    'class' => array(
      'btn',
      $ajax_class,
      'd-none',
      'subbtn-' . $nid
    ),
    'disabled' => 'disabled'
  ),
];
$url = Url::fromRoute('wall.commentform');
$token = \Drupal::csrfToken()->get($url->getInternalPath());

$form['#action'] = Url::fromRoute('wall.commentform')->setOption('query', [FormBuilderInterface::AJAX_FORM_REQUEST => 1, 'token1' => $token])->toString();

Answer 1

After further digging found out the cause for CSRF token not varying.

CSRF token is dependent on session. So until the session is same CSRF token stays same.

Logout and login again and submit the form, you will get new token.

There is an issue reported in Drupal.org for the same even though it is fixed for Drupal 8, it is not working as expected.