- Issue created by @pifagor
- πΊπΈUnited States cilefen
I don't understand whether this bug report is about Drupal Core unaltered or with custom code. If there is custom code, could you please share bug reproduction code?
Have you have called
\Drupal\Core\Routing\UrlGeneratorInterface::generateFromRoute
withuser.logout
to generate the link? - πΊπ¦Ukraine pifagor πΊπ¦ Rivne
The custom code just preparing the link for logout.
"Have you have called \Drupal\Core\Routing\UrlGeneratorInterface::generateFromRoute with user.logout" - yes, but as I wrote before, the token is regenerated constantly, and despite using generateFromRoute, it is constantly out of date in csrfToken->validate. - πΊπΈUnited States cilefen
I am moving this to the development branch in case there is a merge request.
Can you author a failing test for this?
- π¬π§United Kingdom catch
@pifagor in what kind of context is the link being rendered? This sounds like a render caching issue.
CSRF tokens are rendered via a placeholder/lazy builder
(see
$placeholder_render_array = [ '#lazy_builder' => ['route_processor_csrf:renderPlaceholderCsrfToken', [$path]], ];
from RouteProcessorCsrf
However, if the placeholder rendering itself gets cached somehow, or is used in a different context like e-mail, then you end up with invalid CSRF links.