[BUG] PWA cache causes session/CSRF issues and cross-user session leakage

[Gros-Jambon-Fr]

Describe the bug
When the PWA cache is enabled via the UI toggle, several issues occur. Logging out returns a 403 Forbidden: CSRF token from POST incorrect error. Additionally, after logging in with multiple user accounts, clicking "Refresh" on the PWA toast can restore a previous user's session without going through the login form again.

Affected version
1.25.x

To Reproduce
Steps to reproduce the behavior:

1. Enable PWA cache from the bottom-left toggle in the UI
2. Log in with a first user account
3. Log in with a second user account in the same browser
4. Click "Refresh" on the "Viewing cached content" toast → session switches back to the first user without authentication
5. Try to log out → 403 CSRF error

Expected behavior
Each user session should be isolated. Logout should work without CSRF errors regardless of whether the PWA cache is enabled or not.

Screenshots
N/A

Additional context
Running behind a reverse proxy (Traefik) with HTTPS. Redis 7-alpine is used as cache/session backend. Disabling the PWA cache resolves all issues. CSRF_TRUSTED_ORIGINS is properly set.

[l4rm4nd]

Hey @Gros-Jambon-Fr ,

thanks for reporting the issues.

Using a single shared browser will always enable someone to access the data of another user. That's basically the security impact when caching stuff locally within the browser on the same machine. Though, from an application's design principle, we should create a cache per user-account. Not for security but for convenience.I will take a look.

Regarding the CSRF error I will also troubleshoot. Has not occured to me but I am using OIDC SSO.

[l4rm4nd]

Regarding the CSRF error I will also troubleshoot. Has not occured to me but I am using OIDC SSO.

I can reproduce. Happens when browsing from cached sites, which use a stale CSRF token.

[l4rm4nd]

CSRF bug should be gone with the new release.

5b868b0

User-specific caching will take some time. Basically tricky to detect the user and which cache to provide if everything is offline and there is no authenticated state.