Trying to update assignment: Cannot verify CSRF Token Authenticity

[fuhrmanator]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

GitHub Classroom

Hi everyone,

I use GitHub Classroom every summer and I'm trying to set up a new assignment as I always do. EDIT: I don't use the "reuse assignment" feature since it caused headaches in the past. I only use Classroom once a year during summer.

• I can't change the "slug" on the Assignment basics. When I click the button, the entire line disappears.

• When I attempt to update the assignment (enabling the cutoff date, for example) I get the following error: Cannot verify CSRF Token Authenticity

Something seems to be broken. Any help would be appreciated.

---

ETA:

When I load the assignment page there are errors in the console:

application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:1 Uncaught TypeError: Cannot read properties of null (reading 'dataset')
    at isAssignmentAccepted (application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:1:2825)
    at setRepoVisibilityRadios (application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:1:3199)
    at HTMLDocument.<anonymous> (application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:32:13439)
isAssignmentAccepted @ application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:1
setRepoVisibilityRadios @ application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:1
(anonymous) @ application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:32Understand this error
application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:32 Uncaught TypeError: Cannot read properties of null (reading 'style')
    at t (application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:32:25120)
    at NodeList.forEach (<anonymous>)
    at HTMLDocument.<anonymous> (application-91fe7a15d9aff5302302d06855d14682222c5ab38425e12cfb56479043ca8469.js:32:25309)

For privacy reasons I didn't want to paste the assignment URL of the assignment.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[fuhrmanator]

I hope someone can look at this soon -- our labs start this week (Wednesday)

[zippynx]

Hello @fuhrmanator! Since your lab starts this Wednesday, I understand the urgency.

Looking closely at your console logs (TypeError: Cannot read properties of null (reading 'dataset')), this appears to be a frontend regression/bug on GitHub Classroom's side affecting how the form renders the repository visibility or the slug field. The "CSRF Token" error is likely a secondary failure because the broken JavaScript prevents the form from submitting correctly.

While waiting for GitHub staff to deploy a fix, you need a workaround to get your assignments ready. Please try these steps:

Bypass the Buggy UI (The Duplication Workaround): Instead of updating an existing assignment where the UI crashes, try creating a completely new assignment. Sometimes, the bug only triggers on the 'Edit/Update' page of older assignment templates.

Use the GitHub Classroom CLI:
If the web interface is completely broken, you can bypass the frontend entirely using the official GitHub Classroom command-line tool.

Install the CLI.

You can often clone, create, or manage assignments directly from your terminal, which bypasses these JavaScript/CSRF web errors.

Hard Reload & Different Browser:
Just to rule out any cached broken scripts, try a "Hard Reload" (Ctrl + F5 or Cmd + Shift + R) or attempt to edit the assignment using a completely different browser profile (e.g., Firefox if you are on Chrome) with zero extensions.

I hope one of these workarounds allows you to set up the cutoff date for your Wednesday lab! Please let us know if any of these methods successfully bypass the error.

[EltonCN]

I'm also getting the same error when trying to update the date of an assignment. Is there any update on the status of this issue?

[dummy-that-can-be-deleted]

I'm also getting the same error, is there any status tracker or update status for this issue?

[dummy-that-can-be-deleted]

@zippynx I'm pretty sure that the gh classroom cli is only for read only / clone only. We cannot create new class / assignment via gh classroom cli.

Already do the hard reload and the csrf token error still persist, even in incognito / private mode.

Temporary solution:

• Create a new assignment manually (but searching template which already created a lot is a PITA), and do that carefully since we can only create and cannot edit.

[fuhrmanator]

This regression is a good example of code that is pushed to production without adequate automated testing (ironically this is part of my course).

The PITA for creating a new assignment for me is adding all the paths to the "Protected file paths" list (tests already in place).

[witoldprzygoda]

I experience the same problem "Cannot verify CSRF Token Authenticity" when trying to update the deadline. It drives me literally crazy. I observe continuous quality degradation of GitHub Classroom.

[BerndDonner]

I am currently unable to configure a GitHub Classroom assignment correctly because saving changes to the assignment fails with:

Cannot verify CSRF Token Authenticity

This blocks an important assignment setting:

Copy the default branch only
Only the default branch of your repository will be included in your students assignments. If unchecked, all branches will be copied.

What I tried

I tried to create a new assignment from a template repository that contains multiple branches. During assignment creation, I could not find or set the “Copy the default branch only” option properly.

After creating the assignment, I tried to edit/update the assignment to disable “Copy the default branch only”, because I need all branches from the template repository to be copied into the student repositories.

However, saving the updated assignment always fails with:

Cannot verify CSRF Token Authenticity

Expected behavior

I should be able to either:

1. configure “Copy the default branch only” during assignment creation, or
2. update the assignment afterwards and disable this option successfully.

When the option is disabled, newly created student repositories should include all branches from the template repository.

Actual behavior

The assignment appears to be created with only the default branch copied.

When I try to update the assignment afterwards, saving fails with the CSRF token error. As a result, I cannot change the assignment setting and cannot create student repositories with all branches included.

Why this is a serious problem

This is a blocking issue for teaching scenarios where the template repository intentionally contains several branches, for example:

• a default branch with general information,
• one or more exercise branches,
• exam starter branches,
• historical branches that students are supposed to inspect.

In my case, the missing branches are part of the assignment design. The workaround of manually pushing branches into every student repository is possible, but very cumbersome and error-prone.

Environment / context

• Product: GitHub Classroom
• Action: creating and editing an assignment from a template repository
• Problematic setting: Copy the default branch only
• Error message: Cannot verify CSRF Token Authenticity
• Browser/session workarounds such as reloading, logging out/in, and trying again did not solve the problem.

Could someone from the GitHub Classroom team please confirm whether this is a known regression and whether there is a workaround or ETA for a fix?

[egenomics]

Same problem here...

[mrericreed]

+1

[ddefb]

+1

[dweitzer]

+1

[witoldprzygoda]

+1

[dTaylorTC]

+1

[profjpbaugh]

Same issue. This makes GitHub classroom challenging to use properly (along with other issues like the "Repo not found" nonsense that happens CONSTANTLY) and it seems like the GitHub team doesn't really pay much attention to it. Very disappointing, because the concept and general functionality is a great idea.

Is GitHub Classroom still being maintained or is it just abandonware?

[fuhrmanator]

In both sections of my summer course, 80+ students this semester nearly all got the error "access lost" to the repo, and the workaround is to have them visit their GitHub notification page and accept the invitation to join. Something changed in the workflow so that students who join a classroom/assignment don't automatically accept the invitation. Stuff breaks, I guess it's normal.

Every summer for at least 4 years, there are bugs like this. I get the impression that we are the integration testers for the fall semester. Sadly, GitHub has copilot agents, actions that can run integration tests, etc. I've used them to refactor code and make sure it didn't break, and even run pre-prod integration tests on a self-hosted system with GitHub actions. The tech is there to make sure these bugs don't make it to production.

[velyamini]

same issue. The assignment is active. trying to add the cutoff date and time. But couldn't update...

[azzamabdulkhadar]

The error “Cannot verify CSRF Token Authenticity” usually happens in backend frameworks when the CSRF token is missing, expired, or invalid.

1. Refresh the page and try again.

Sometimes the session/token expires.

2. Clear browser cookies/cache

Old session cookies often cause this.

3. Logout and login again

Creates a fresh CSRF token.

Make sure the CSRF token exists inside the form.

[witoldprzygoda]

No, it does not fix the case.

[fuhrmanator]

100% working fixes

This is signature LLM chatbot nonsense. Please, if you just pasted that from an AI response thinking it's helpful, you made a big mistake.

Edit to add links to community rules for not posting AI content: https://github.com/community/community/blob/08b54a7433f00555d19d0cdd4981c86a7c04b411/CODE_OF_CONDUCT.md#reasonable-use-of-ai-generated-content

[ghostinhershell]

Hi @azzamabdulkhadar,

We’ve clarified our stance on using generative AI tools like ChatGPT within our Community via this announcement. Please review the guidelines to ensure your post meets them as failure to adhere to those rules can result in action taken by our moderator team.  You can read our updated Code of Conduct and the announcement for more details. Thank you for helping us maintain an authentic and beneficial space for everyone.

[azzamabdulkhadar]

Well, you can try this. perhaps it will work.

Log out of GitHub completely.
Clear cookies/cache for:
github.com
classroom.github.com
Open GitHub Classroom in incognito/private mode.
Disable all extensions temporarily (especially ad blockers/privacy extensions).
Try another browser (Chrome/Edge/Firefox).
Make sure you are logged into only one GitHub account.
Hard refresh the page:
Windows: Ctrl + Shift + R

If still broken, revoke and reconnect GitHub Classroom access:
GitHub → Settings → Applications → Authorized OAuth Apps → Remove GitHub Classroom → Login again.

Finally, create a new assignment instead of editing the old one (this fixes many CSRF issues).

Official pages:
GitHub Classroom
GitHub Settings Applications

[brunomateus]

I have done that and it only solved when I created a new assignment. However, if we have an option to edit assignment then it should be possible to be used and, it is not.

It's annoying to create a new assignment, share a new link because we need to change the deadline.

The problem is that someone changed the HTML and one document.getElemetById is returning undefined. Consequently, some piece of code are now broken. It does not look like hard to solve.

[khinachika12]

Looks like a CSRF/session cache issue in GitHub Classroom try re-login or an incognito window and see if the slug edit works again; when troubleshooting setups I also use contador de horas to keep track of time spent on fixes and configuration.

[P-r-e-m-i-u-m]

The console errors make this look like a GitHub Classroom frontend regression, not a normal CSRF/session mistake.

A normal CSRF issue is usually fixed by signing out/in or clearing cookies. In your case, the page is throwing JavaScript errors before the form works:

Cannot read properties of null (reading 'dataset')
Cannot read properties of null (reading 'style')

That strongly suggests the assignment edit page is expecting a DOM element that is missing for this assignment state. The CSRF error is probably a secondary symptom because the form submit/update flow is broken after the JS crash.

GitHub Classroom docs confirm assignments are supposed to be editable from the Classroom UI, and GitHub CLI can list/view/clone Classroom assignments, but the CLI does not appear to provide a full replacement for editing every assignment setting such as cutoff dates or template branch-copy behavior.

Docs:

• About assignments: https://docs.github.com/en/education/manage-coursework-with-github-classroom/teach-with-github-classroom/about-assignments
• Classroom with GitHub CLI: https://docs.github.com/en/education/manage-coursework-with-github-classroom/teach-with-github-classroom/using-github-classroom-with-github-cli

Practical workaround while waiting for GitHub:

1. Create a brand-new assignment from scratch instead of editing the broken one.
2. Avoid reusing/copying the old assignment if the old assignment page is what triggers the null-element error.
3. If you need all branches from a template repo and the UI will not save that option, create a test student repo first and confirm the branch behavior before giving students the invite link.
4. If students already accepted, avoid deleting/recreating unless you have a migration plan.

For GitHub staff, I would add a minimized report with:

• assignment type: individual or group
• whether it uses a template repository
• whether the template has multiple branches
• whether any students have already accepted
• browser and OS
• the two console stack traces
• exact setting that fails to save

Because multiple instructors are now seeing this, it would help to state whether this started on existing assignments only or also brand-new assignments.

[languard]

+1 Error still exists. I cannot edit the titles of assignments to match new naming convention for my courses.