ezsystems/ezpublish-kernel — pull request #858 by lolautruche (2014-05-13 14:47:01+00:00)
Title: Fix EZP-22643 "Missing form token from Request " when creating an object after clearing cache

https://jira.ez.no/browse/EZP-22643
Should also fix https://jira.ez.no/browse/EZP-22589

Very hard to reproduce, so this patch is somewhat *theoretical*.

## What I could reproduce *sometimes*
* I found that requests going through Ajax (tree menu and children list in admin) sometimes get 403 response code
* This 403 comes from an non-authenticated user (assuming anonymous), because of session not started (while it actually is in this case, but most likely hidden state from Symfony session laziness)
* When session is not started, current user id is overwritten by `eZUser::instance()`.
* For some reason when refreshing the page the session is active again, so no error any more

In my case, it seemed to happen when the session wasn't active for a moment (~20min, which is close to default `gc.max_lifetime` set by Symfony).

## Assumptions
* When the session is *sleeping* (or let's say *inactive* for some time), it is marked as not started in the Session storage.
* As of e9d22c724b7cfb05aad7d43f1ec9dcf2b4971aea, if session is not started the dynamic session name is not set, which makes legacy `eZSession` fail to find the session.
* No session => No Csrf protection => no token generated => :boom: