Anyone who left a panel screen open and came back later could lose what they had typed: the session had changed, the CSRF token was no longer valid and saving returned a 403.
How it works
The server now answers an invalid token with a code of its own, CSRF_INVALID_OR_EXPIRED. The global JavaScript recognises that answer, asks _gestor-csrf-token for a new token and resends the same request. This covers the three paths the system uses: fetch, jQuery.ajax and XMLHttpRequest.
Not mistaken for missing permission
A 403 without that mark is not CSRF, and is not retried: an access denial stays a denial.
When the tab becomes visible again, the token is checked before the user clicks anything.
Source: Core · req-175 · BATCH-180 · release 2.10.13