Drupal form throws error on submission

Question

A drupal form throws the below error on submission. The form is loaded and immediatly submitted and user is not ideal on browser.

'This form is outdated. Reload the page and try again' 

I am using two drupal nodes with a common database and a web server(load balancer) but the above error seems to appear when the form is rendered from one app server and the submit request goes to the other app server.

I wanted to understand where are the form tokens stored, i am assuming in the database. The above message appears because the form token in both the cases is different and app server assumes that the request is not part of the same session.

Also I am using apc cache so not sure if that has anything to do with it.

Thanks,

Answer 1

The tokens are stored in the db/form cache, but is generated using the php session ID so as far as I understand it if you generate the form on one server, then submit to the other, it will regenerate the token when it checks it, using a different session ID so won't match - from common.inc:

function drupal_get_token($value = '') {
  return drupal_hmac_base64($value, session_id() . drupal_get_private_key() . drupal_get_hash_salt());
}

What are you using as the load balancer? You may need to look at enabling sticky sessions if you can.

Answer 2

I had the very same issue. A load balancer spreads traffic between two web nodes. Drupal would give me This form is outdated. Reload the page and try again every now and then. The error would happen when a form was generated on one web node but submitted to the other.

I started by looking at drupal_validate_form which (among other things) validates the submitted form against the form token stored in $form_state['values']['form_token']. Jump over to drupal_valid_token and then to drupal_get_token. The function drupal_get_hash_salt() turned out to return non-consistent results on the two servers.

For some reason, $drupal_hash_salt was set on only one of the servers. On the server which was not set, Drupal would fall back to generate a salt based on the database settings.

The issue was resolved by setting $drupal_hash_salt in settings.php to the same value.