I think the issue is that when gZip compression is enabled, the page cache is stored in compressed format. And during the rendering of that cached page, it's not able to replace the CSRF token properly since the data is stored in gZip format.

So, the solution could be something like this:

Filename: libraries/joomla/cache/cache.php
Method: getWorkarounds

....
....
                // The following code searches for a token in the cached page and replaces it with the proper token.
		if (isset($data['body']))
		{
			$token       = JSession::getFormToken();
			$search      = '#<input type="hidden" name="[0-9a-f]{32}" value="1" />#';
			$replacement = '<input type="hidden" name="' . $token . '" value="1" />';
			
			// Assuming that Gzip is enabled, Need to check dynamicall though :-)
			$cached_data = $data['body'];
			$uncompressed_data = gzdecode($cached_data);
			$processed_data = preg_replace($search, $replacement, $uncompressed_data);
			$data['body'] = gzencode($processed_data, 4, FORCE_GZIP);
                        
                        // NEED TO COMMENT OUT FOLLOWING LINE
			// $data['body'] = preg_replace($search, $replacement, $data['body']);
			$body         = $data['body'];
		}
....
....

Any thoughts?

This is nothing to do with gzip

This is expected behaviour.

Once a change of user authentication has occurred, the session should be regenerated for security, and this will force a token change.

This is by design.

Closing than. Thanks @PhilETaylor

@PhilETaylor Thanks for your reply.

Yes, I understand once user is logged in, the particular token associated with that session is expired. But, the issue (as per my understanding, please correct me If I'm wrong) is that when you open login page in two "different" browsers (IE and FF for example), both should serve different tokens at first place considering that they both are different sessions although accessed from the same PC.

But the same scenario works when gzip is disabled. I mean, when gzip is disabled, and I open login page in two different browsers it serves me different token.

Any ideas, why that is so?

My previous comments were on the basis of two tabs in the same browser - I stand by those in that context.

I see you edited your reply, so I have now investigated with two different browsers

I cannot replicate your problem with a Firefox and a Chrome browser, with or without gzip enabled.

All I see is the expected behaviour. I can login with both browsers in independent sessions with no token issues.

@PhilETaylor Ok thanks.