Invalid Security Token on backend after upgrade from OC

[Tony-S]

I'm trying to convert my October projects to winter. I've followed the upgrade guide https://wintercms.com/blog/post/how-start-using-winter-cms using the composer route to upgrade my site. The site is basically running, frontend is fine but the backend continuously gives me Invalid Security Token. I've managed to log out of backend then trying to login again, I get the login screen ok but on entering my details I get Invalid security token. I've refreshed the page, I've done php artisan cache:clear and I've cleared browser cookies. No change. Any thoughts?
Thanks

[Tony-S]

OK, I've solved this, it looks to be an incompatible plugin. I was using Cydrick Nonog's Backend Skin https://octobercms.com/plugin/cyd293-backendskin. Directly after upgrade I could see that this was now breaking the header in the backend. It seems it was also causing the invalid security token as I disabled the plugin in the database and all started working.

[LukeTowers]

Odd, was this a result of the plugin itself or your custom backend skin that you were applying? From a brief glance over the public repo for the plugin I don't see anything that sticks out as causing the issue.

[Tony-S]

Actually the plugin seems to be fine thanks. It was because of the custom backend skin (specifically head and default layouts) that I was using which I had to update to latest Winter versions, then reapply my modifications. Once I'd done this everything was fine. Thanks for your input.

[LukeTowers]

Glad to hear it! Anything specific that would be helpful to anyone else dealing with similar issues?

[Tony-S]

I was overriding layouts/_head.htm and layouts/default.htm. Both overrides were working fine in October 1.0.472 but had been created based on a much earlier version. What specifically caused the issues I don't know. I just got the latest wn versions and reapplied my changes. A quick test just now indicates that default.htm is fine with only one line different and that wasn't the issue, it is likely the changes in _head.htm. A large part of _head.htm where scripts and style sheets are loaded and https checking is done, is very different from my old oc file.