Theme negotiation fails during ajax requests for anonymous users (ex: views exposed filters with ajax enabled).
AjaxBasePageNegotiator::determineActiveTheme() attempts to validate the theme_token passed as part of the ajax request. This validation will always fail for anonymous users because they don't have an active session.
Remove the CSRF token validation all together
- OR -
Add an additional check to only execute the CSRF validation if the current user is authenticated.
Active
11.0 🔥
theme system
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Added an additional check to only execute the CSRF validation if the current user is authenticated.
Left a comment in the MR but this will also need test coverage for the scenario described