← all change records
#3591939 CSRF token validation with the 'rest' key is deprecated in Drupal 11.4.0 and removed in Drupal 12.0.0
Generated 2026-08-02 02:00 UTC
Matching rules (1)
- from:
arg: 0
fqn: '\Drupal\Core\Access\CsrfTokenGenerator::get'
string_in:
- rest
to:
arg: 0
const_in:
- '\Drupal\Core\Access\CsrfRequestHeaderAccessCheck::TOKEN_KEY'
fqn: '\Drupal\Core\Access\CsrfTokenGenerator::get'
Affected contrib projects (22)
| Project | legacy | in_flight | migrated | installs | files | adopters | |
|---|---|---|---|---|---|---|---|
| email_registration ↗ | 5 | 0 | 0 | 23,965 | 1 | 0 | |
| login_emailusername ↗ | 8 | 0 | 0 | 15,880 | 1 | 0 | |
| canvas ↗ | 0 | 0 | 19 | 8,549 | 0 | 2 | |
| jsonapi_resources ↗ | 0 | 0 | 7 | 7,703 | 0 | 1 | |
| gutenberg ↗ | 0 | 0 | 17 | 5,198 | 0 | 1 | |
| acquia_contenthub ↗ | 92 | 0 | 0 | 932 | 3 | 0 | |
| rest_password ↗ | 21 | 0 | 0 | 568 | 1 | 0 | |
| flowdrop ↗ | 12 | 0 | 0 | 240 | 1 | 0 | |
| webform_jsonschema ↗ | 0 | 0 | 10 | 73 | 0 | 1 | |
| rest_mail_login ↗ | 3 | 0 | 0 | 71 | 1 | 0 | |
| rest_register_verify_email ↗ | 11 | 0 | 0 | 68 | 1 | 0 | |
| social_auth_decoupled ↗ | 14 | 0 | 0 | 25 | 2 | 0 | |
| simpleavs ↗ | 0 | 1 | 0 | 21 | 1 | 1 | |
| swagger_ui_info ↗ | 1 | 0 | 0 | 15 | 1 | 0 | |
| experience_builder ↗ | 0 | 0 | 10 | 11 | 0 | 1 | |
| one_time_login_rest ↗ | 2 | 0 | 0 | 6 | 1 | 0 | |
| ckeditor_taxonomy_glossary ↗ | 0 | 0 | 1 | 2 | 0 | 1 | |
| mobile_number_login_otp ↗ | 6 | 0 | 0 | 2 | 1 | 0 | |
| tapis_app_webform ↗ | 0 | 0 | 1 | 2 | 0 | 1 | |
| eb ↗ | 0 | 0 | 2 | 1 | 0 | 1 | |
| sdx_aurora ↗ | 2 | 0 | 0 | 1 | 1 | 0 | |
| api_insight_lab ↗ | 3 | 0 | 0 | 0 | 1 | 0 |