"Invalid request token!" after update to contao 2.10

Don't know what happened here but I updated contao to v2.10 and it works fine first day. Now for some reason I got following error every time when I try to log-in to back-end. I tried to change privileges to folders, database is up-to-date as well... Anyone came across this ?

Quote:

---

Invalid request token!

The request token could not be verified. Please go back and try again.

This error occurres if there is a POST request without a valid authentication token. In Contao 2.10, the referer check has been replaced with a request token system. If the problem persists, you are maybe using an incompatible third-party extension or have not correctly updated your Contao installation.

For more information, visit the Contao FAQ page or search the Contao forum.

---

Hello,

I guess that this happens because one of the extensions you use is not Contao 2.10 ready. Which extensions do you use?

Jan

Nope. This happens just when you try to login.

It happens when your token has become invalid, or it was used before. I requested this to be changed, and Leo implemented it into the next release of Contao (2.10.3). He implemented the best option he had imho; the tokens are valid throughout your entire session. That should take care of the error messages.

What I did in the meantime is disabling the tokens altogether. I'll update every 2.10.x site to 2.10.3 as soon as available.

I store the URL in the bookmark, so that when you go there, it redirects to logon and then goes to the main page. The benefit of doing this is that if you are already logged in, it doesn't log you out, it just loads the home. However if you use this bookmark, it generates the invalid token.

http://www.site.com/contao/main.php

I think I remember reading the token system didn't change for the backend... When would you need that functionality? I was always logged out before when closing a tab? Right?

Quote:

---

Originally Posted by Ruud

What I did in the meantime is disabling the tokens altogether.

---

How to disable these tokens as this error is every time when I try to log in and unfortunately does not allow me to login even I reload page, clear browser cashe etc...

Your problem sounds more serious. Perhaps you need to report that as a bug/problem. If something is still wrong with the most current version it should be fixed.Can you log into the online demo backend?

Disabling the tokens can be done in the localconfig.php. I'll lookup what the setting is called, although you can also look for it yourself in the othr files in that dir. Ptobably config.php...

@miro:
I guess this could be a problem with an incorrect server/PHP configuration, e.g. an invalid "session.save_path" etc.

Quote:

---

Originally Posted by xchs

@miro:
I guess this could be a problem with an incorrect server/PHP configuration, e.g. an invalid "session.save_path" etc.

---

So if I'm seeing this:

Warning: Unknown: open(/var/php_sessions/sess_6f78ad10c397854028abe8854fc6cd75, O_RDWR) failed: No such file or directory (2) in Unknown on line 0
#0 [internal function]: __error(2, 'Unknown: open(/...', 'Unknown', 0, Array)
#1 {main}

Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/php_sessions) in Unknown on line 0
#0 [internal function]: __error(2, 'Unknown: Failed...', 'Unknown', 0, Array

at the bottom when I am trying to install for the first time, then it would seem that it would be an issue with what you call an incorrect server / PHP configuration? So how do I change that? I don't know what that means. How do I find "session.save_path" and what do I do when I've found it. I've done only one other install of Contao and it went smoothly so I'm lost.
When I click Accept License right from the get go, It is giving me the same "invalid token request" message as the original poster of this thread. The difference is that it is a first time clean install and I haven't gotten past contao/install.php step.
I'd greatly appreciate some help.

Quote:

---

Originally Posted by michelle

How do I find "session.save_path" and what do I do when I've found it.

---

For instance, you can check this in the PHP configuration. Create a new file "phpinfo.php" in the website root and add

Code:

---

<?php phpinfo(); ?>

---

into this file. Then, run this script in your browser und you should get a comprehensive overview of the current PHP configuration. There you should find a hint for the "session.save_path".

Either way, if you can't modify the server configuration by yourself you would have to refer to your hosting provider in order to do such tasks for you.

Thanks greatly xchs. I went through the hosting company and they got everything sorted out for me and I'm off and running.