Contrib.social

Access denied error on warning links from update module - invalid csrf_token

Open on Drupal.org →
Created on 13 March 2023, almost 2 years ago
Updated 9 June 2023, over 1 year ago

Problem/Motivation

On the Extend (/admin/modules) page, when there is no data about available updates, a warning is displayed:

No update information available. Run cron or check manually.

'Run cron' is a link to /admin/reports/status/run-cron and 'check manually' is a link to /admin/reports/updates/check. Both queries have destination and csrf_token parameters - eg

/admin/reports/updates/check?destination=/admin/modules&token=CBZRlulFTH8gW_6DOzzFPvANhv3hgZZGZgPlEhP9noY

If you click on either link, you get an access denied error - eg:

Path: /admin/reports/updates/check?destination=/admin/modules&token=CBZRlulFTH8gW_6DOzzFPvANhv3hgZZGZgPlEhP9noY. Drupal\Core\Http\Exception\CacheableAccessDeniedHttpException: 'csrf_token' URL query argument is invalid. in Drupal\Core\Routing\AccessAwareRouter->checkAccess() (line 112 of /var/lib/tugboat/stm/web/core/lib/Drupal/Core/Routing/AccessAwareRouter.php).

Steps to reproduce

I created a 10.x sandbox site on simplytest.me, logged in as admin, navigated to /admin/modules, tried to click on either of the links displayed there in the warning message, and got this error.

This may be related to the fix for #2646328: CSRF in update module manual check links → .

🐛 Bug report
Status

Needs work

Version

11.0 🔥

Component
Update  →

Last updated 11 days ago

  • Maintained by
  • 🇺🇸United States @tedbow
  • 🇺🇸United States @dww
Created by

🇺🇸United States brad.bulger

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024