Hello,

After enabling form security validation ($g_form_security_validation = ON), APPLICATION ERROR #2800 ("Invalid form security token") occurs on the login flow under a specific condition.

Environment:

• MantisBT 2.28.3
• $g_form_security_validation = ON (required; we cannot turn it OFF for security remediation and company guidelines)
• Login is the two-step flow: login_page.php (username) → login_password_page.php (password) → login.php
• Browser: [Chrome / Edge]
• OS: [Windows]

Actual result:
APPLICATION ERROR #2800 – Invalid form security token. The message suggests session timeout or accidental double submit.

Expected result:
Login should succeed, or the user should get a clear “session expired, please reload” without a hard 2800 after only 0000007:0000015 minutes of idle on the username field with CSRF enabled.

Additional observations:

• If, after the same idle period, the username is chosen from the browser’s suggested/autofill list (click suggestion) instead of typing, the error does NOT occur.
• The issue appears only when typing the username after idle; autofill click works.
• So far we only see this on the login flow, not on other forms (still under test).
• We keep $g_form_security_validation = ON on purpose (CSRF remediation). We are not asking to disable form tokens.

Screenshot of ERROR #2800 is attached.

Questions for developers:

1. Is ~ 15 minutes idle on login_page expected to invalidate the form token while the PHP session may still be alive?
2. Is there a recommended pattern for the username → password login steps (token lifetime, purge, PRG) so idle + manual typing does not hit 2800?
3. Any known interaction between form security tokens and browser autofill vs manual input on the login forms?

Thank you for any guidance.

Best regards