D7: Strict token mismatch: Expected [] Received [_quant/validate]

A quant-token is added to the header for _quant/validate in quant_form_quant_config_validate:

  $url = "$base/_quant/validate";
  $options['headers']['quant-token'] = quant_token_create($url);
  $response = drupal_http_request($url, $options);

In quant_init, if a token is present and strict is enabled, it will check as follows:

  $path = current_path();
  $path_alias = drupal_lookup_path('alias', $path);
  $strict = variable_get('quant_token_strict', true);

  if (quant_token_validate($path_alias, $strict)) {
    return;
  }

  if (quant_token_validate($path, $strict)) {
    return;
  }

But, _quant/validate doesn't have an alias which is why the expected value is empty.

I'm unclear why the token is being added and this validate route is getting checked.

Unassigning because I don't know how to move this forward.

Given things work even with this issue, changing this to minor.

There are others. Examples:

Strict token mismatch: Expected [] Received [node/1]
Strict token mismatch: Expected [] Received [taxonomy/term/1]
Strict token mismatch: Expected [] Received [sitemap.xml]
Strict token mismatch: Expected [] Received [sitemap.xsl]
Strict token mismatch: Expected [] Received [node]

PR: https://github.com/quantcdn/drupal/pull/169

Kristen Pol → credited steveworley → .

Merged to GitHub. Will be in the next release.

Included in the 7.x-1.2 release → .