543254 - Outdated/long opened pages with forms tell about error on submission

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Collections, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

I see this with add-on detail pages and review detail pages:

If the page has been open for a long time (more than 2 hours?), the submission complains about errors in this form. The back button goes back to a page which redirects again to this page.

Comment 1

[Fred Wenzel [:wenzel]]

It's the CSRF protection. The "shared secret" between client and server expires after a while. So this is expected (albeit in your case undesired) behavior.

jbalogh: Do you know how Django's CSRF tokens work? Will this still be a problem in Zamboni?

Comment 2

[Jeff Balogh (:jbalogh)]

From http://docs.djangoproject.com/en/dev/ref/contrib/csrf/#how-it-works:
A CSRF cookie that is set to a random value (a session independent nonce, as it is called)...

From that I gather that there won't be any current/previous epoch shenanigans.

Comment 3

[Jeff Balogh (:jbalogh)]

Eh, we're not really gaining anything by keeping this bug open.