OTRS Invalid Challenge Token why it happens?

[zbigniew]

OTRS 4.0.6+ITSM

I see in logs "Invalid Challenge Token" and do not understand why it appears - application works fine.

The code which displays this error message is here:
/opt/otrs/Kernel/Output/HTML/Layout.pm
Rows 823 and 828 - both inside single function: ChallengeTokenCheck
I know there is option to disable it:
Framework -> Core::Session -> SessionCSRFProtection
but would prefer to keep it on and find what causes this. This function as understand CSRF attack is for protecting user from hostile session capture by someone else.

Is it possible that it appears if logging in from several web browsers/tabs or computers? Nobody uses otrs - it is just set for testing in LAN network. Only few people has access.

[crythias]

Is it possible that it appears if logging in from several web browsers/tabs or computers?

Or someone clicks a link with a challenge key that has expired.