A CSRF token is what a server includes in its response, that is the same token which is passed in the request from the user.
In my case, a different CSRF token is getting included in the request- which is hence generating a 403 Forbidden error.
Along the different CSRF token cookie, a new session ID cookie is also getting included, which should not be the case. I am guessing a new session is somehow getting created and hence including a different CSRF token but I am really not sure how and why is this happening. Seems a sort of re-login is happening.
What is more interesting is that this is happening only for a specific user. Any ideas what might be the case?