CFWheels Invalid Authenticity Token error

[cfcoder]

I'm running into this error after auto logout has occurred and during the first subsequent login. If I reload the login page first, then all is well. But if I login from the login page that I was redirected to from the logout action, then I get this:

Wheels.InvalidAuthenticityToken
This POSTed request was attempted without a valid authenticity token.

The login submits a new.cfm page (the login page) form that has a controller.action of sessions.create. But this error occurs for /sessions (that's what shows in the url for this error) and has not even reached the create action yet. I know because I put a writedump and abort in the create and it is not hit.

Clearly, a normal page reload clears up the problem but going from the redirect after logout is, I believe, removing the token from session. I don't know where that token is normally being generated and added to the session scope. I don't know why the redirect to the new.cfm page doesn't recreate that token but a subsequent normal reload of the new.cfm does generate it.

Any suggestions welcomed here.

[cfcoder]

I have now found where the authenticity tokens get generated. It appears to occur in the tag where this code was placed inside wrapper tags:

#csrfMetaTags()#

That tag block containing that call is in the /views/layout.cfm file. So it's not clear to me yet why the error occurs when in fact the new.cfm page load from redirect or from a manual reload of the page would make any difference because layout is used for both situations. No conditions are placed around this code that generates the csrf authenticity token.

[neokoenig]

I don't know what your "auto logout" procedure entails, but it could be that you're redirecting to the page when the old session is still valid.

If that's the case then it's possible the CSRF tags from the old session (which has now expired) are being sent to your login POST request.

i.e

• Session A: Auto logout triggers
• Session A: Loads "you need to login again page" with Session A CSRF token
• Session A: then actually times out, and Session A is destroyed
• Form is submitted without a page reload so still has Session A's CSRF token which is now invalid.
• Page is refreshed which starts Session B, loads in the CSRF token and all is ok.

Note you will get Wheels.InvalidAuthenticityToken error if either there is no token, OR if there is a token but that token is invalid.