Branch: refs/heads/stable-18.9.x Home: https://github.com/xwiki/xwiki-platform Commit: aa1880bb813f10b001011bf78f149aa3c59fd96e https://github.com/xwiki/xwiki-platform/commit/aa1880bb813f10b001011bf78f149... Author: ciaens <[email protected]> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-csrf/pom.xml M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/script/CSRFTokenScriptService.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenConfigurationTest.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenTest.java M xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/WikiEditIT.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-api/src/main/java/org/xwiki/security/authentication/AuthenticationConfiguration.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm Log Message: ----------- XWIKI-25243: Make CSRF tokens identical on all nodes of a cluster (#6769) * DefaultCSRFToken derives the token (first 16 bytes of HMAC-SHA256 keyed with the authentication validation key, message "csrf:" + serialized user reference (or "guest") + ":" + time period) instead of storing random tokens in memory, so every node sharing the key computes the same token and tokens survive restarts * The tokens rotate with a time period: new csrf.tokenLifetime property (hours, default 24, 0 = never expire), the token of the previous period is still accepted * Add CSRFTokenConfiguration#getTokenLifetime (default method) and document the property in xwiki.properties.vm * The validation key is read once and a blank or missing key fails with an explicit IllegalStateException * Token validation uses a constant-time comparison and the warning no longer logs the expected token * Deprecate CSRFToken#clearToken and CSRFTokenScriptService#clearToken, a no-op for the default implementation * Document in AuthenticationConfiguration that the keys must be stable across calls and across cluster nodes * Depend on xwiki-platform-security-authentication-api, drop the SecureRandom and Initializable code * Expand the one-line Javadoc comments of the touched files to the multi-line form * Rewrite DefaultCSRFTokenTest for the derived tokens (key cache, blank key, period rotation, previous period, lifetime 0) and raise the coverage threshold of the module to 0.86 * WikiEditIT.allowForceSaveWhenCSRFIssue tampers the form_token field instead of clearing the server token Co-authored-by: Claude <[email protected]> (cherry picked from commit 0d77f91a9512bd32c9daf527e618a17c9fe6a022) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications