“Token not provided” after two-factor authentication
The message is not about your six-digit code but about Dolibarr’s anti-CSRF token. What the 23.0.3 code says, and where to start the diagnosis.
You log in, two-factor authentication goes through, and at the first document download Dolibarr displays “Token not provided”. The message talks about a token, and you immediately think of the six-digit code. It is not the same token.
Which token it is
Dolibarr protects its forms against cross-site request forgery — CSRF. The principle: each page generates a token, and every sensitive action must send it back. If a request arrives without this token, Dolibarr refuses it, and that is exactly what the message says.
The token in question therefore has nothing to do with your six-digit code: it is a page token, invisible, specific to your session. It is missing because the request reaching the download page did not come from the page that would have signed it.
A surprising point
The Dolibarr 23 core does not ship a working two-factor authentication. If you have one, it comes from a third-party module. This matters for the diagnosis: the behaviour you observe then depends on that module, not only on Dolibarr — and that is where you should start looking.
What was verified
- Code of 23.0.3 read: common entry point of the pages, security functions, credentials handling.
- Code compared between 23.0.3 and 23.0.4: nothing has changed on this point. Upgrading to 23.0.4 will therefore not solve the problem on its own.
The case of a particular user was not reproduced: the final cause depends on their installation and their two-factor authentication module. What follows is a method, not a remote diagnosis.
Where to start
- Identify the installed two-factor authentication module, and its version.
- Disable it for the duration of a test: if the error disappears, that is where the issue lies, and not in the core.
- Look at where the failing request comes from. A pasted link, a bookmark, an automated call or a page left open for a long time will not have a valid token.
What not to do
You will find advice online that amounts to disabling the anti-CSRF check to silence the message. That is removing a lock because you have lost the key. The check is doing exactly its job: the right question is why a request arrives without a token, not how to stop Dolibarr from noticing.