Handle 422 ActionController::InvalidAuthenticityToken error more gracefully

Problem

We're seeing 422 errors consistently on GitLab.com, with users unable to sign in if they retry but able to in a different browser window.

This is confusing, gives users no indication of the problem, and appears like GitLab.com is down for that user.

Frequency

These errors happen throughout the day, and don't line up with a deploy.

screenshot_2020-02-04-12_28_57 screenshot_2020-02-04-12_41_52

Potential solutions

  • Clear session and redirect users back to sign in
  • Display a more useful error message that users may be able to understand
  • Reduce frequency that users hit this on GitLab.com. What is the root cause of these errors?