| CSRF tokens are kept in a JVM-local map (DefaultCSRFToken). In a cluster behind a load balancer without sticky sessions, a form rendered by one node and submitted to another is rejected ("Secret CSRF token verification failed"), and a node restart invalidates every open form. Proposal: derive the token deterministically with an HMAC of the authentication validation key (xwiki.authentication.validationKey, which a cluster already has to share for cookies to work) and the user reference, so every node computes the same token. Compare tokens in constant time. |
