Ever since upgrading JomSocial to the latest release, i have received the below error message upon successful login.
Seems like yet another redirection error!

The most recent request was denied because it contained an invalid security token. Please refresh the page and try again.
This error has ONLY occurred since updating JomSocial.

Access details attached... Please read additional notes.

Hi,

this is joomla issue:
github.com/joomla/joomla-cms/issues/9626

please try to turn off all cache plugins

Regards

So you're suggesting that directly after updating JomSocial again, the error occurs without so much as changing a single setting to anything else on the site. Same as last time, when I was informed in no uncertain terms that it was NOT a JomSocial error, did it transpire to be a coding error in the JomSocial redirect plugin.

FYI: the suggested Joomla cache plugin is at fault is preposterous IT'S BEEN DISABLED FOR MONTHS!
I paid for support, which seems to always be the fault of anything else but JomSocial and invariably it's a JomSocial issue at the end of an exhausting and lengthy trial of blame.

I've just paid you another $79 today because your updater refused to update the outdated Socialise T3 library.

Hi, Zurkster.

I have issues to reach your site: i.prntscr.com/5af394cd0cbc46b19a804de874842606.png
It says: "Server not found".

Please, note that out updater (you probably mean iJoomla Installer) doesn't update T3 plugin.
T3 plugin is 3rd party extension and pelongs to JoomlArt. Any issues with oneclick upgrade need to be reported to them.
Anyway in template we provide link to plugin download page: i.prntscr.com/5748fc4772a14f728c57a0140fe43d47.png
Where you can download it manually and install using Joomla! installer.

AS I KEEP REPEATING, WE HAVE CHANGED OUR DOMAIN MORE THAN EIGHT MONTHS AGO AND THE OLD SITE TO WHICH OUR SUPPORT WAS INITIALLY REGISTERED WITH DOES NOT EXIST, EVEN THOUGH WE HAVE LISTED OUR ONLY DOMAIN ON THE ACCOUNTS PAGE ON JS, WE ARE UNABLE TO MIGRATE OUR SUPPORT TO OUR LIVE SITE.
NO MICHAL I DID NOT MEAN iJOOMLA UPDATER, JOOMLA UPDATER LISTED THE T3 MODULE FOR SOME WHILE BUT WOULD NOT UPDATE.

Even though the Socialise v2 template is listed under our Jomsocial and is apparently the ONLY template that supposedly works with Jomsocial, you are saying that it's a third party responsibility. even though our SUPPORT IS PAID TO JOMSOCIAL $79 YESTERDAY!

So even though our subscription for support is with JomSocial, I have to speak to ANOTHER company's support forum to resolve any potential issues with them. IF that's the case, why do we pay you for the Socialise v2 template?

OK, so now answer this one. WHEN I DISABLE THE JOMSOCIAL REDIRECT PLUGIN, OUR SITE FUNCTIONS CORRECTLY.

AND MICHAL THE LAST TIME WE GAVE YOU ACCESS TO OUR SITE, YOU PUBLICLY ANNOUNCED ON THIS FORUM OUR FULL ADMINISTRATOR URL INCLUDING THE SECURITY MEASURE!

JomSocial is fast becoming a real pain in that I spend allot of my time correcting errors created by JomSocial updates.

HI, Zurkster.

If you changed your site domain.. why you didn't requested supported domain change?
How we suppose to know which domain is valid? You supported domain is zurkernation.com. Other domains that are listed are NOT supported sites/domains but just and information that you use JS on other sites.

Please, post a supported domain change request here: www.jomsocial.com/forum/billing-issues

Socialize template is not the only template that works with JomSocial. It's designed to get more juice from JomSocial... but you're free to use any template you want.

As I said before - T3 plugin is 3rd party extension. When you click on plugin update button in template, you're taken to... Joomla! update page and there you may update the plugin... but update URL is wrong. So updating plugin IS NOT the part of the template. Upgrade is done directly in Joomla! And Joomla! may use upgrade xml path... provided by extension developer. In this case it's JoomlArt. So we or Joomla! CAN'T be responsible for wrong path provided by developer... in their extension. Anyway as I mentioned - we provide direct link to download page so you may download and install plugin manually.

How can we say whet is really wrong with your site... as we can't access it? Albertus presumed that you use certain version of JomSocial so provided possible solution. It could be more accurate ONLY IF we could access your site and investigate the issue there...

AND MICHAL THE LAST TIME WE GAVE YOU ACCESS TO OUR SITE, YOU PUBLICLY ANNOUNCED ON THIS FORUM OUR FULL ADMINISTRATOR URL INCLUDING THE SECURITY MEASURE!

@MIchal The post in question was deleted from the forum after I complained that you had posted our administrator URL publicly. This is the reason you cannot find it, such a reply should NEVER have been submitted in the first place, in future we prefer to deal with senior members of JomSocial staff only and request you refrain from answering our support questions.

The issue appears to be this time as a result of a conflict with the security tokens issued by Joomla and affects pages immediately after login. The post login pages are all JomSocial related

The below documentation explains the conflict and how to avoid it. We have only suffered this error since JomSocial was most recently updated.

https://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms

@Albertus We do not have any plugins or features with enabled caches, all caching has been disabled during beta development, therefore it cannot be a caching issue. This also doesn't explain why this error only started after the last JS update. NO other components or add-ons have been modified or updated.

Hi,

sorry, I need to access your site. you can edit your firs post at put valid credentials information at site info form (private)

did you try this solutions?
github.com/joomla/joomla-cms/issues/9626
www.finallybinary.com/joomla-invalid-security-token/

Regards

HI, Zurkster.

For your information I am a senior JomSocial staff and Support Manager. That's why I answered your question. I talked with Paul Smith who was a Support Manager before me and he confirmed that such a situation took place. So yes, it was our fault but we fixed it quickly by removing sensitive data from thread. This only proves that we took it seriously... and we've learned a lesson so it won't happen in future. Please, accept our apologies again...

Let's focus on your current issue. We don't want to waste your time so before we could suggest any possible solution we need to take a look into your site settings. In order to do that we need two things:

- please, post a supported domain change request here: www.jomsocial.com/forum/billing-issues . Changing domain will take less than 1 minute and we'll be sure where to look your site. Also such a request will stay on forum for the record.

- after supported domain will be changed, please, edit your first post here and provide SU credentials. Credentials fields are visible ONLY for us and our connection is encrypted with SSL: i.prntscr.com/e500e145207c459d8f71c68bd8654526.png So it's safe to provide them.

Without changed domain and site credentials we can't provide you our support with success.

@Albertus I have attached the requested SU account access details to the first message.

Please forgive my 'sometimes' abrupt manner and somewhat forward attitude, I have had a number of bad experiences with support from some developers who insist JomSocial is the non-compliant component in the cut throat SN and CMS software industry. I have to agree that JomSocial on it's own is second to none in the social networking arena, but lacks both the correct speed of support channels required for an active live SN installation, if our platform were to suffer a large disruption or downtime once we go 'live' (out of beta) our site could/would collapse quickly. Your JomSocial platform needs to be 100% capable of providing the utmost level of technical support if the site should be affected by an erroneous update. Which seems to be when things normally hit the fan! LOL

@Michal Although I was right about the posting of the sensitive URL publicly, more importantly you chose to respond with a defensive attitude to my information, in fact your response more-so inferred that I was wrong and that you felt it your place to search through the entire list of support tickets to confirm your claim.

I felt that a (senior) JomSocial Staff and support manager PUBLICLY accused me of lying on the very support forum for which I seek help with problems usually generated by your software updates. most of which I resolve on my own. NOT ASKING FOR SUPPORT for which I have repeatedly paid. As requesting support often leads to conflict of interest and accusations.

I do not wish to enter into any disagreement over a product, for which we are paying for support we feel we do not get in a timely fashion, or when I as the lone developer need assistance, only be confronted with accusation. Michal it is easy for you to say 'Lets say sorry and move on' What about the question of 'trust' and professionalism one should expect from a 'senior member of staff' I requested to receive responses from a senior member of staff, meaning someone whom is senior to you, which by definition of the fact that you have even replied after Albertus is somewhat disrespectful of my request to communicate with an alternative member of staff.

Hi,

not sure why I cant replicate the issue at your site.
I login - logout couple times and visit any pages at your site. all normal, it works like expected.

regarding your joomla global configuration please decrease your session lifetime from 2880 minutes to 120 minutes, and turn off the cache, right now still using progresive cache.

Regards

HI Albertus, firstly the session time-out was a suggestion by one developer to reduce the session failure rate, which was a temporary work-around and did not constitute a permanent remedy. There are bigger issues at hand and I will attempt to list them here.

2. I have read that Joomla since v3.5.1 has suffered at the hand of the new security token. Perhaps there's a conflict there between Joomla and JomSocial?

3. I've also looked into the fix that was used initially with the JomSocial redirect plugin, could there still be issues somehow with that area?

The token error displays at shorter session time-outs, if you attempt to login from a fresh browser or saved bookmark the site quite frequently misbehaves. I'm at my wits end with the various errors that transpire only seemingly after long periods of stable operation, although very slow page loads around all JomSocial pages.

4. The JomSocial component displays a geo-location popup error (see attached pic). Cause unknown but has been displayed since the introduction of the latest 4.1.2 JomSocial.

Hope this helps explain a bit more, i have to go out now but will return later, it would be beneficial if someone from your team could discuss this on my site in real-time, I believe we could address this much more effectively using this live communications method.

Hi,

2.
there is no security token issue for joomla 3.5.1 + jomsocial 4.2.1, only some users got login popup issue because OPcache issue at server side, not jomsocial

3.
token issue not related with JomSocial redirect plugin. could you please elaborate more how to replicate token issue at your site? I tried all day long. still I cant replicate it. please try to emptying joomla session table, and delete session cookies at browser

4.
this issue has been fixed, please edit:
administrator/components/com_community/views/community/tmpl/default.php line 853

alert('Geocode was not successful for the following reason: ' + status);

console.log('Geocode was not successful for the following reason: ' + status);

Thank you for your answers, at least I can address one issue here, the last you mentioned, however as I stated, I have not got access to FTP to modify the aforementioned file. Is it possible in this situation to create said fixed file and present it in the form of an installable patch, that just overwrites the affected file? Surely with your expertise and skill-sets, the staff at JomSocial could find this a much more effective method of rolling out 'fix' patches.

Thank you in advance for your continued support.