I unfortunately do not work anymore for the company where I encountered this issue.
But I tried to create a small reproducer and I cannot see the warning anymore.

But if I understand your solution, you clear the CSRF token even if we are on a stateless route?

Because currently, the user is not logged out from stateful request when he logs out on stateless request.
So I believe we should not clear his csrf tokens too.

Clearing the CSRF tokens doesn't log out from the session. It just prevents reuse of existing tokens for next requests.

Clearing the CSRF tokens doesn't log out from the session. It just prevents reuse of existing tokens for next requests.

Yes, but the file you modified is a listener on the logout event.

And when I tested it few month ago, I saw that logging out on a stateless route doesn't affect stateful session.
Users keep their session in stateful routes but with your change they will lose their csrf tokens.

Sure. And not sure about the business requirements on this topic. This might be app-specific.

How do you feel about the new approach in #54742? Up to finish the PR?

Closing in favor of #54742