---
title: "Breaking: #97305 - Introduce CSRF-like login token"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:breaking-97305-1664100009"
source: "Changelog/12.0/Breaking-97305-IntroduceCSRF-likeLoginToken.rst"
typo3-version: "12.0"
typo3-major: 12
type: "breaking"
issue: 97305
forge: "https://forge.typo3.org/issues/97305"
tags: ["Backend", "Fluid", "Frontend", "NotScanned", "ext:core"]
rendered: "2026-09-23T16:35:56+00:00"
---

# Breaking: #97305 - Introduce CSRF-like login token {#breaking-97305-1664100009}

See [forge#97305](https://forge.typo3.org/issues/97305)

## Description {#description}

`\TYPO3\CMS\Core\Authentication\AbstractUserAuthentication` requires a
CSRF-like request-token to continue with the authentication process and to
create an actual server-side user session.

The request-token has to be submitted by one of these ways:

-   HTTP body, e.g. in `<form>` via parameter `__request_token`
-   HTTP header, e.g. in XHR via header `X-TYPO3-RequestToken`

## Impact {#impact}

Core user authentication is protected by a CSRF-like request-token, to
mitigate [Login CSRF](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html).

Custom implementations for login templates or client-side authentication
handling have to be adjusted to submit the required request-token.

## Affected installations {#affected-installations}

Sites having custom implementations for login templates or client-side authentication.

## Migration {#migration}

The `\TYPO3\CMS\Core\Security\RequestToken` signed with a `\TYPO3\CMS\Core\Security\Nonce`
needs to be sent as JSON Web Token (JWT) to the server-side application handling of
the Core user authentication process. The scope needs to be `core/user-auth/be`
or `core/user-auth/fe` \- depending on whether authentication is applied in
the website's backend or frontend context.

### Example for overridden backend login HTML template (`ext:backend`) {#example-for-overridden-backend-login-html-template-ext-backend}

```diff
--- a/typo3/sysext/backend/Resources/Private/Layouts/Login.html
+++ b/typo3/sysext/backend/Resources/Private/Layouts/Login.html
 <input type="hidden" name="redirect_url" value="{redirectUrl}" />
 <input type="hidden" name="loginRefresh" value="{loginRefresh}" />
+<input type="hidden" name="{requestTokenName}" value="{requestTokenValue}" />
```

### Example for overridden frontend login HTML template (`ext:felogin`) {#example-for-overridden-frontend-login-html-template-ext-felogin}

```diff
--- a/typo3/sysext/felogin/Resources/Private/Templates/Login/Login.html
+++ b/typo3/sysext/felogin/Resources/Private/Templates/Login/Login.html
-<f:form target="_top" fieldNamePrefix="" action="login">
+<f:form target="_top" fieldNamePrefix="" action="login" requestToken="{requestToken}">
```

More details are explained in corresponding documentation on
[Feature #87616: Introduce CSRF-like request-token handling](https://docs.typo3.org/permalink/changelog:feature-97305-1664099950).