A user.logout doesn't work anymore with the CSRF token changes in issue 144538

I don't understand whether this bug report is about Drupal Core unaltered or with custom code. If there is custom code, could you please share bug reproduction code?

Have you have called \Drupal\Core\Routing\UrlGeneratorInterface::generateFromRoute with user.logout to generate the link?

The custom code just preparing the link for logout.
"Have you have called \Drupal\Core\Routing\UrlGeneratorInterface::generateFromRoute with user.logout" - yes, but as I wrote before, the token is regenerated constantly, and despite using generateFromRoute, it is constantly out of date in csrfToken->validate.

I am moving this to the development branch in case there is a merge request.

Can you author a failing test for this?

@pifagor in what kind of context is the link being rendered? This sounds like a render caching issue.

CSRF tokens are rendered via a placeholder/lazy builder

(see

   $placeholder_render_array = [
          '#lazy_builder' => ['route_processor_csrf:renderPlaceholderCsrfToken', [$path]],
        ];

from RouteProcessorCsrf

However, if the placeholder rendering itself gets cached somehow, or is used in a different context like e-mail, then you end up with invalid CSRF links.