[5.x]: [Craft 5] CSRF token invalidated by provisional draft creation causes 400 errors on modal actions (assets, links) for unsaved entries

What happened?

Description

When creating a new entry and performing certain actions (opening the asset browser, inserting a link to an entry) before the entry has been saved for the first time, the following action endpoints return 400 errors:

• POST actions/element-indexes/get-elements
• POST actions/app/icon-svg

The suspected cause is that Craft 5 creates a provisional draft in the background when a new unsaved entry is opened. This appears to rotate or invalidate the CSRF token that was issued with the original page load. Subsequent action requests (such as opening a modal) are then rejected with 400 because they carry the old token.

This was introduced or changed in the Craft 5.x series.

---

Steps to reproduce

1. Create a new entry (do not save it).
2. Begin adding content to the draft — add text, use fields, etc.
3. After a few interactions, open a pop-up modal — e.g. the asset browser (add an image) or link to an entry.
4. Observe 400 responses on the above endpoints.
5. Note that some errors also occur when Live Preview is opened without saving first.

---

Expected behavior

CSRF tokens remain valid throughout an editing session for an unsaved provisional draft, so modal actions (asset browser, link picker, etc.) work correctly before the first save.

---

Actual behavior

• POST actions/element-indexes/get-elements → 400
• POST actions/app/icon-svg → 400
• The asset browser folder does not open.
• Console shows: Uncaught (in promise) undefined
• Errors begin after a few requests, typically when a modal is first triggered.

Craft CMS version

5.10.5

PHP version

8.4.10

Operating system and version

Linux 6.17.0-1017-aws

Database type and version

MySQL 8.0.44

Image driver and version

GD 8.4.10

Installed plugins and versions

1781142808277.log
1781142675392.log

Reproduce the unsaved-entry flow, then inspect the POST actions/element-indexes/get-elements and actions/app/icon-svg requests alongside the provisional-draft and CSRF behavior described in the report. Confirm whether the token changes after draft creation or Live Preview opens, and verify that asset-browser and link-picker modal actions no longer return 400 before the first save.