XID created for every page load and many non-form items increasing size exp_security_hashes table. Bug with 2.7.1?

Question

Here's the setup:

• secure forms turned on
• empty template (there are no forms, nothing at all in the template)
• EE 2.7.1
• logged in/out (makes no difference)
• empty exp_security_hashes table

Every time I refresh/load the empty template in my browser an extra hash is created in the exp_security_hashes table.

From reading the docs I understood the XID was only created for forms. Am I missing something?

Creating a new XID for every page load on the front end doesn't seem right! Maybe 'secure forms' should be renamed 'secure site'.

Edit: And this template creates two XIDs, one for the form and the other for the (page??). Each XID is different but sames session_id.

{exp:user:edit return="myprofile/success" form:id="form_2" screen_name_password_required="no" dynamic="off" }
<input type="text" name="username" value="{username}"/>
<input type="submit" name="submit">
{/exp:user:edit}

The XID for the page is never set to 'used' so is never cleared.

And it looks like the XIDs dont get cleared until ee()->security->garbage_collect_xids() is called once every 7 days.

I've raised this as a bug and await EE response, which Ill post here.

Answer 1

Edit: heres the bug report response from EE

It’s really not a bug, but it would be nice if we could only generate it when needed- i.e., the template parser spots a form tag. The sticking point is ajax and how the lack of an xid would jam things up there.

I know this started the devs bouncing some ideas around, but at the moment, the behavior is expected. And to be clear, it’s always generated the xid on page load- so while it would be great if they come up with a way to reduce those xid inserts, it’s not adding new overhead.

The issue i see is xids are also being created for more things than just page load and forms, which dont appear to be 'used' and cleared, resulting in quickly increasing size for exp_security_hashes table.

My solution for now, is to just run this via a cron job every day

ee()->security->garbage_collect_xids()