CSRF tokens shared by all cluster nodes
Last modified by Thomas Mortagne on 2026/10/14 11:14
The CSRF token of a user is now derived from the authentication validation key instead of being kept in memory: it survives a restart, and all the nodes of a cluster accept the same token as long as they share the same xwiki.authentication.validationKey (see Clustering). Tokens now rotate every 24 hours by default (a token stays valid 24 to 48 hours), which can be changed with the new csrf.tokenLifetime property of xwiki.properties.
