"Invalid CSRF token" on any actions by registered users
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

None

Authored By

	MBH
	Mar 31 2025, 3:09 AM

Description

I'm user MBH. I tried to revert last edit on [1] and got
Session Error. There appears to be a problem with your current session; this action has been cancelled to prevent "session hijacking". Please resubmit the form.
I reloaded a page and got the same error. I tried to edit a page manually and got the same error. I tried to log out: pressed a blue button on https://ru.wikipedia.org/wiki/Special:Userlogout and it takes me back to the same page (without logging out).

I can't logout (https://commons.wikimedia.org/wiki/Special:UserLogout) and edit also on Commons (tried to edit https://commons.wikimedia.org/wiki/Category:UMMC_Museum_Complex)

[1]: https://ru.wikipedia.org/w/index.php?title=Talk:%D0%92%D1%82%D0%BE%D1%80%D0%B6%D0%B5%D0%BD%D0%B8%D0%B5_%D0%B2_%D1%8D%D1%84%D0%B8%D1%80&action=history

[impossible to log out due to "Invalid CSRF token"]

Related Objects

Mentioned In: T255179: Session failures ("invalid CSRF token") preventing edits, login, logout, etc due to kask outage

Event Timeline

MBH created this task.Mar 31 2025, 3:09 AM

Restricted Application added subscribers: Base, Aklapper. · View Herald TranscriptMar 31 2025, 3:09 AM

I also can't log out from another account (user:Железный капут) on another browser (Firefox, main browser is Chrome) due to "Invalid CSRF token"

I have raised this to the highest priority as it presumably means all MediaWiki sites are broken.

AntiCompositeNumber added projects: Wikimedia-Incident, SRE.Mar 31 2025, 3:14 AM

I get similar message when trying to login:

Screenshot 2025-03-30 231505.png (507×318 px, 13 KB)

Benwing2 updated the task description. (Show Details)Mar 31 2025, 3:17 AM

The log-in trouble described above, is when using Firefox. In Chrome I am logged in, but can not edit due to error:
Sorry! We could not process your edit due to a loss of session data.

You might have been logged out. Please verify that you're still logged in and try again. If it still does not work, try logging out and logging back in, and check that your browser allows cookies from this site.

Screenshot 2025-03-30 231823.png (310×1 px, 34 KB)

And when trying to log out I get: "Invalid CSRF token"

Benwing2 mentioned this in T255179: Session failures ("invalid CSRF token") preventing edits, login, logout, etc due to kask outage.Mar 31 2025, 3:23 AM

EnWIki user here. Using Edge on Win11 I get the same errors as Jarekt. Same with Chrome on my mobile.
Also, "email this user" doesn't work, the page just blinks but stays the same when I click "Send"

Looking at "Recent changes" it looks like IPs can edit. So there's going to be a lot of mess to clear up!

Devs are looking into it. https://www.wikimediastatus.net/incidents/1w3rq4d2zljj

I'm running into the same issue. Couldn't edit (with a message about needing to log out), then couldn't log out ("invalid CSRF token"), cleared my browser's saved data to force log out, and now it's impossible to log in.

Ahecht awarded a token.Mar 31 2025, 3:33 AM

MBH renamed this task from I can't edit "to prevent session hijacking" and log out to "Invalid CSRF token" on any actions by registered users.Mar 31 2025, 3:34 AM

Yiming subscribed.Mar 31 2025, 3:35 AM

Dragoniez awarded a token.Mar 31 2025, 3:35 AM

Anoop subscribed.Mar 31 2025, 3:37 AM

Dragoniez subscribed.Mar 31 2025, 3:46 AM

Fixed.

Thanks for your quick work!

Xaosflux subscribed.Mar 31 2025, 10:02 AM

Investigation into the root cause and avoiding repeats of this event is in progress at T390514.

• bd808 removed MBH as the assignee of this task.Mar 31 2025, 5:44 PM

JeanFred subscribed.May 2 2025, 10:32 PM

	F58950599: Screenshot 2025-03-30 231823.png
	Mar 31 2025, 3:22 AM

	F58950593: Screenshot 2025-03-30 231505.png
	Mar 31 2025, 3:16 AM

"Invalid CSRF token" on any actions by registered usersClosed, ResolvedPublicBUG REPORTActions

Description

Related Objects

Event Timeline

"Invalid CSRF token" on any actions by registered users
Closed, ResolvedPublicBUG REPORT
Actions