diff --git a/app/Controllers/authController.php b/app/Controllers/authController.php
index d279d15bd..e5afda72b 100644
--- a/app/Controllers/authController.php
+++ b/app/Controllers/authController.php
@@ -230,6 +230,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
 		if (Minz_Request::isPost()) {
 			invalidateHttpCache();
 			FreshRSS_Auth::removeAccess();
+			Minz_Session::_param('csrf', false);
 			Minz_Session::regenerateID('FreshRSS');
 			Minz_Request::good(
 				_t('feedback.auth.logout.success'),
diff --git a/app/Controllers/userController.php b/app/Controllers/userController.php
index 8b356553f..c0a75c95a 100644
--- a/app/Controllers/userController.php
+++ b/app/Controllers/userController.php
@@ -713,6 +713,7 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 
 			if ($ok && $self_deletion) {
 				FreshRSS_Auth::removeAccess();
+				Minz_Session::_param('csrf', false);
 				$redirect_url = ['c' => 'index', 'a' => 'index'];
 			}
 			invalidateHttpCache();
diff --git a/app/FreshRSS.php b/app/FreshRSS.php
index 251425de3..1376285e8 100644
--- a/app/FreshRSS.php
+++ b/app/FreshRSS.php
@@ -72,15 +72,8 @@ class FreshRSS extends Minz_FrontController {
 	private static function initAuth(): void {
 		FreshRSS_Auth::init();
 		if (Minz_Request::isPost()) {
-			if (!FreshRSS_Context::hasSystemConf() || !(FreshRSS_Auth::isCsrfOk() ||
-				(Minz_Request::controllerName() === 'auth' && Minz_Request::actionName() === 'login') ||
-				(Minz_Request::controllerName() === 'user' && Minz_Request::actionName() === 'create' && !FreshRSS_Auth::hasAccess('admin')) ||
-				(Minz_Request::controllerName() === 'feed' && Minz_Request::actionName() === 'actualize' &&
-					FreshRSS_Auth::allowAnonymousRefresh()) ||
-				(Minz_Request::controllerName() === 'javascript' && Minz_Request::actionName() === 'actualize' &&
-					FreshRSS_Auth::allowAnonymous())
-				)) {
-				// Token-based protection against XSRF attacks, except for the login or self-create user forms
+			if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Auth::isCsrfOk()) {
+				// Token-based protection against CSRF attacks
 				self::initI18n();
 				Minz_Error::error(403, ['error' => [_t('feedback.access.denied'), ' [CSRF]']]);
 			}
diff --git a/app/Models/Auth.php b/app/Models/Auth.php
index dd925b676..10883057d 100644
--- a/app/Models/Auth.php
+++ b/app/Models/Auth.php
@@ -19,6 +19,7 @@ class FreshRSS_Auth {
 		if (isset($_SESSION['REMOTE_USER']) && $_SESSION['REMOTE_USER'] !== FreshRSS_http_Util::httpAuthUser()) {
 			//HTTP REMOTE_USER has changed
 			self::removeAccess();
+			Minz_Session::_param('csrf', false);
 		}
 
 		self::$login_ok = Minz_Session::paramBoolean('loginOk');
@@ -27,7 +28,6 @@ class FreshRSS_Auth {
 			$current_user = FreshRSS_Context::systemConf()->default_user;
 			Minz_Session::_params([
 				Minz_User::CURRENT_USER => $current_user,
-				'csrf' => false,
 			]);
 		}
 
@@ -166,7 +166,7 @@ class FreshRSS_Auth {
 		Minz_Session::_params([
 			'loginOk' => false,
 			'lastReauth' => false,
-			'csrf' => false,
+			// 'csrf' => false, // Must be refreshed separately
 			'REMOTE_USER' => false,
 		]);