Prevent HTML Prefetch, Preload, Prerender (and The Like) From Invalidating the Form Tokens
taufik-nurrohman opened this issue · comments
Form tokens are updated on every page visits. Adding HTML5 prefetch, preload and prerender features causes the token values to be refreshed in the background. Need to find a way to detect if current page was accessed in the background and so we could disable the token refresh.
Possible Solutions
- Refresh the token only if it is accessed from the same URL.
- Token refresh should be made limited to the current URL only. So, refreshing token on the other pages would only update token values for that pages.
- Refresh the token only after form submission.
- Refresh the token after certain time-out.
👍 - Detect response header specific to prefetching from all browsers.
👎
Related: taufik-nurrohman/f3h#10