@baris Probably I got the problem (or rather problems).
Homepage for my forum is set to custom page based on plugin:
Sadly it looks that it's missing applying csrf token, so in the situation when custom page is loaded first - each next loaded dynamically (without page refresh) will be without csrf token (until user refresh forum on other page, like topic or categories).
It could be easier to catch, but in my case there was also that my file upload was in the custom plugin with own route. And I was creating it like:
router.get('/groups/:slug/lesson/:lessonId/:name', middleware.buildHeader, lessonController.render);
instead of using helper:
const routesHelpers = require.main.require('./src/routes/helpers');
routesHelpers.setupPageRoute(app, '/groups/:slug/lesson/:lessonId/:name', middleware, , lessonController.render);
It would be great if you can confirm that
nodebb-plugin-custom-pages really could make the trouble, thanks!