CSRF token error message and PHP SessionHandler Warnings

[afonseca08]

Bug Description

I am getting the following error message displayed in the Mautic UI:
"CSRF token error. Try to refresh the page and try again."

It happens when I've had the Mautic window open for several hours or overnight and then return to it. It looks like I remain signed into Mautic but the error displays until I refresh the browser. Upon refreshing it continues to work normally. Note: I have selected for Mautic to remember me so I don't have to sign in again.

Q	A
Mautic version	2.15.0
PHP version	7.1.25
Browser	Chrome Version 71.0.3578.98 (Official Build) (64-bit), Safari version 12.0.2 (14606.3.4)

Steps to reproduce

1. Sign into Mautic, choose to stay signed in.
2. Have any Mautic page open, and leave it open for several hours or overnight.
3. Observe the error message appears in the UI.
4. Refresh the browser and observe error message goes away.
5. Can reproduce again by going to step 2.

Log errors

From mautic/app/logs:
[2019-01-04 17:23:49] mautic.WARNING: PHP Warning - SessionHandler::read(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' - in file /home/afonseca/public_html/mautic/vendor/symfony/http-foundation/Session/Storage/Proxy/SessionHandlerProxy.php - at line 62 [] []
[2019-01-04 17:23:50] mautic.WARNING: PHP Warning - SessionHandler::write(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' - in file /home/afonseca/public_html/mautic/vendor/symfony/http-foundation/Session/Storage/Proxy/SessionHandlerProxy.php - at line 70 [] []
[2019-01-04 17:23:50] mautic.WARNING: PHP Warning - session_write_close(): Failed to write session data using user defined save handler. (session.save_path: /var/cpanel/php/sessions/ea-php71) - in file /home/afonseca/public_html/mautic/vendor/symfony/http-foundation/Session/Storage/NativeSessionStorage.php - at line 241 [] []

[onlineexpert]

I have the exact same findings in Chrome 70.0.3538.110 for quite some time and assumed it is a Chrome specific issue.

[dsp76]

I have the exact same findings in Chrome 70.0.3538.110 for quite some time and assumed it is a Chrome specific issue.

Did it not happen with other browsers?

[onlineexpert]

I cannot confirm that it does or does not happen with other browsers since I occasionally use Firefox and Safari but never when working with Mautic.

[afonseca08]

I can confirm it also repros on Safari version 12.0.2 (14606.3.4).

[ced-mohitp]

Any update on this, as I'm getting this since I've updated my mautic to version 2.15.0

[ManasN]

I get this issue on firefox too, using ubu 16

[incentfit]

I get it too. Mautic version 2.15.2 running on nginx on ubuntu 18.

[pety-dc]

We experienced the same.
I look into how mautic tries to keep the session alive.
There is an idletimer that tracks when the mautic user goes idle, goes away and comes back.
But it doesn't ping the server while you are away
If you remain away for longer than the session is alive, the server kicks you out.

[npracht]

@afonseca08 @ManasN @online-expert @dsp76 @ced-mohitp can you test #7883 ?

[PierreAmmeloot]

It's OK for me.

[PierreAmmeloot]

@escopecz when you can merge bux fix directly on master branch?

[afonseca08]

@npracht, I verified the fix using MautiBox. I did not see the error message appear.

[escopecz]

A release leader can merge PRs. There is no release leader for the next Mautic 2.x version yet.

[PierreAmmeloot]

@escopecz who can designate a leader for the next release?

[escopecz]

That's not the right question to ask. A better question is:

Who wants to step up to be a release leader?

A release leader can be anyone who has a history of code contributions into Mautic.

[PierreAmmeloot]

What exactly is the role of a release leader? If you wish I can surely help. :-)

[escopecz]

A release leader is responsible for 1 release. She/he must ensure that all merged PRs are tested properly so there must be some activity in the community to help test some PRs. Also, no bad (vulnerable, slow, hard-to-maintain, ...) code should not be merged. Then there must be a beta release and a production release. A release leader must have a write permission to the mautic/mautic repository. DB Hurley can grant such permission based on the past contributions.

[PierreAmmeloot]

@escopecz I can do this if you want. What's your opinion, @dbhurley do you agree?

[dennisameling]

#7883 has been merged now for the 2.16 release, so I'm closing this issue. Thanks for providing the PR @pety-dc!