CSRF token regenerated on every request with "System - Community Builder"

Environment:
- Joomla 6.1.4, PHP 8.3.35 - Community Builder 2.12.0 (reinstalled over existing install, same result)
- Shared hosting with Varnish in front (X-Cacheable: NO, pages not cached)
- Session handler: database, lifetime 60, cookie_domain/cookie_path empty, force_ssl = 2
- No page cache, CB login module cache disabled

Issue: Login through the CB login module always fails with "Session expired or cookies are not enabled in your browser", on both production and a test copy, including in private browsing.

Findings:
- Joomla's csrf.token changes on every page reload (frontend only).
- The browser sends the same Joomla session cookie on each request, and Joomla does not send a new Set-Cookie.
- The matching row in #__session exists but its "time" and data are never updated after the first request, so session data is never written back.
- Administrator session works normally (row updated on each request).
- Disabling only "System - Community Builder" (all else unchanged): csrf.token stays stable across reloads.
- Plugin is published, Public access, ordered first among system plugins. - Disabling bfstop / Regular Labs with CB enabled: no change.

Workaround: Joomla native login module, CB login module unpublished.

Note: not the Page Cache case from thread 248177 — System - Page Cache is disabled, responses are sent with no-cache headers, and the token changes on every reload rather than being frozen.

Any idea what in the CB system plugin could prevent the Joomla session from being written at the end of the request?
 

We don't set $forceNew so it shouldn't be regenerating on each load of the login module. The CSRF token generation is entirely on Joomla so whether Joomla needs to regenerate it or not is entirely up to Joomla. We're just calling getFormToken and checkToken methods same as anywhere else in Joomla.

Are you sure CBs system plugin is the cause of your issue? I'm not seeing this behavior on Joomla 4, Joomla 5, or Joomla 6. CSRF is also working fine on our demosite. Do you have any 3rd party CB plugins installed?

An issue like this usually suggestions your sessions themselves are generating on every request. I recommend checking within your Joomla _session table and see if it's doing exactly that.

Give this a try. Within System > Manage > Plugins edit "System - Community Builder" then set "Redirect URLs" and "Rewrite URLs" to "Disabled" then publish the plugin again and see if it's still doing this. If it isn't turn on "Redirect URLs" then retry and see if it's still happening. If it isn't do the same for "Rewrite URLs". This should at least help narrow things down.