Quoting: tuubiAh. I don't really see a good way to get around this if the user takes long enough to type their reply that their session is already gone when they submit the form. I guess they might load a bunch of articles in tabs and only get around to actually reading them and commenting a few hours later. Maybe... add the token on demand when the user actually starts to comment/reply instead of when they load the articles or threads?

This just gave me a bright idea. I think I know part of the issue here, it's our AJAX pagination system as it only reloads the comments area and not the comment box so if their session reloads when a new comment page is loaded they will get a new token but the comment box is not updated with it.

Edit: okay so this newer code should now be live, hopefully it will help.

Last edited by Liam Dawe on 7 August 2021 at 6:27 pm UTC

Quoting: Liam DaweHow long were you on the page when it happens?

Probably quite a while. I do, as people have discussed here, typically open quite a few GoL tabs and work through them gradually.
I haven't had any problems so far today, so hopefully your fix/es are working. Thanks for looking at it!

Added a further fix: the site now pings a session refresher every 5 minutes to keep it alive, which should solve 99% of the issues while still keeping forms secure from cross-site requests.

Quoting: Liam DaweAdded a further fix: the site now pings a session refresher every 5 minutes to keep it alive, which should solve 99% of the issues while still keeping forms secure from cross-site requests.

I can confirm that a few minutes ago I did a reply on a tab which I'd opened earlier in the morning and only got around to looking at hours later, and it did not stop me.

Sorry for late reply, it seems to be fixed for me too. Thanks Liam!

Glad to know it's sorted. People could say that refreshing the session in the background is a potential problem for people who leave their browser open and walk away or whatever - but that's also true for literally every other website out there that has a login, it's basically the only way to ensure people don't lose stuff.

So will consider this sorted.