we are experiencing intermittent login failures with Community Builder on Joomla 6. I have been able to reproduce the issue reliably and traced it down to CB's form-token validation.Reproducible scenario
- User A is logged in.
- User A logs out.
- The login form is used to log in as User B.
- Instead of logging in, Community Builder displays:
Session expired or cookies are not enabled in your browser. Please press "reload page" in your browser, and enable cookies in your browser.
The German translation is
.The issue has been observed with Firefox on Windows. We also have a user for whom the problem occurs intermittently on two Windows computers, while login from Firefox on Android works.Clearing the site's cookies/session data temporarily appears to resolve the issue.What I foundThe failing request is:
Code:
POST /einloggen → HTTP 200
A successful login produces:
Code:
POST /einloggen → HTTP 303
I traced the failing request to
Code:
components/com_comprofiler/comprofiler.php
, function
.Before username/password authentication takes place, CB performs:
Code:
if ( ! Application::Session()->checkFormToken() ) {
return;
}
This calls
Code:
CBLib\Session\Session::checkFormToken()
:
Code:
if ( Application::Cms()->checkFormToken( $method ) ) {
return true;
}
$error = CBTxt::Th(
'UE_SESSION_EXPIRED',
'The most recent request was denied because it had an invalid security token. Please go back or refresh the page and try again.'
);
For Joomla 6, CB ultimately delegates this to:
Code:
return Session::checkToken( $method );
So the failure occurs during CSRF token validation, before CB evaluates the supplied username or password.The token is present in the POSTI inspected the failed POST request in Firefox Developer Tools. The form does contain the Joomla/CB token, for example:
Code:
7aad6c5e3ff32f7154b9c11281481279: "1"
along with the normal CB login fields (
Code:
option=com_comprofiler
,
,
,
Code:
loginfrom=loginform
, username, password, etc.).CB generates this field using:
Code:
Application::Session()->getFormTokenInput()
with the token name supplied by Joomla and value
.Therefore this does not appear to be a case where the browser simply omits the CSRF token.
Code:
Session::checkToken('post')
rejects a token that is present in the submitted form.Additional observationIn another occurrence we saw the following sequence:
Code:
POST /einloggen → 303
GET /home → client cancelled request
POST /einloggen → 200
The first POST had actually authenticated the user successfully. Nevertheless, the subsequent POST resulted in the
message. The user could see the error message while already being logged in ("Logout" was displayed in the site navigation).QuestionsCould this be a known issue with Community Builder's session/CSRF handling on Joomla 6, particularly after logout/session regeneration?Is there anything specific we should check regarding CB login forms and Joomla session regeneration after logout?I can reproduce the "User A logout → User B login → invalid token" case and can add temporary diagnostic logging if you need the expected token, submitted token and Joomla session ID for the GET/POST sequence.One additional minor issue: the current German
translation still says that the session has expired or cookies are disabled, while the current English default string correctly describes the actual condition as an invalid security token. This made the issue initially look like a browser-cookie problem.
