diff --git a/src/main/java/org/olat/ims/qti21/ui/AssessmentTestDisplayController.java b/src/main/java/org/olat/ims/qti21/ui/AssessmentTestDisplayController.java
index 74db7029ae19dc56a7afc95d0989535c0531a00f..e1de1fe7947e5275381949db58e9e9502251650d 100644
--- a/src/main/java/org/olat/ims/qti21/ui/AssessmentTestDisplayController.java
+++ b/src/main/java/org/olat/ims/qti21/ui/AssessmentTestDisplayController.java
@@ -780,6 +780,9 @@ public class AssessmentTestDisplayController extends BasicController implements
 		
 		TestSessionState testSessionState = testSessionController.getTestSessionState();
 		Date startTime = testSessionState.getDurationIntervalStartTime();
+		if(startTime == null) {
+			startTime = testSessionState.getEntryTime();
+		}
 		if(startTime == null) {
 			startTime = candidateSession.getCreationDate();
 		}
diff --git a/src/main/java/org/olat/ims/qti21/ui/components/AssessmentObjectComponentRenderer.java b/src/main/java/org/olat/ims/qti21/ui/components/AssessmentObjectComponentRenderer.java
index cdbc7b2893eb26199a26d6a79a79ecfaa28b9fe7..b3d00b8489878920314a75f1e6863a5c817bff7c 100644
--- a/src/main/java/org/olat/ims/qti21/ui/components/AssessmentObjectComponentRenderer.java
+++ b/src/main/java/org/olat/ims/qti21/ui/components/AssessmentObjectComponentRenderer.java
@@ -1328,7 +1328,8 @@ public abstract class AssessmentObjectComponentRenderer extends DefaultComponent
 			  .append("  formName:'").append(form.getFormName()).append("',\n")
 			  .append("  dispIdField:'").append(form.getDispatchFieldId()).append("',\n")
 			  .append("  dispId:'").append(component.getQtiItem().getFormDispatchId()).append("',\n")
-			  .append("  eventIdField:'").append(form.getEventFieldId()).append("'\n")
+			  .append("  eventIdField:'").append(form.getEventFieldId()).append("',\n")
+			  .append("  csrf:'").append(renderer.getRenderer().getCsrfToken()).append("',\n")
 			  .append(" }).tabOverride();\n")
 			  .append("})\n")
 			  .append(FormJSHelper.getJSEnd());
diff --git a/src/main/webapp/static/js/jquery/qti/jquery.qtiAutosave.js b/src/main/webapp/static/js/jquery/qti/jquery.qtiAutosave.js
index 9bec4353339fb59bd24d3e9a77b70b580fc235a7..ab5b7b8ad171fb9624d4112524b95bd80115f6ae 100644
--- a/src/main/webapp/static/js/jquery/qti/jquery.qtiAutosave.js
+++ b/src/main/webapp/static/js/jquery/qti/jquery.qtiAutosave.js
@@ -1,11 +1,14 @@
 (function ($) {
+    "use strict";
+    
     $.fn.qtiAutosave = function(options) {
     	var settings = $.extend({
     		responseUniqueId: null,
     		formName: null,//form name
     		dispIdField: null,//form dispatch id
     		dispId: null,//item id
-    		eventIdField: null // form eventFieldId
+    		eventIdField: null, // form eventFieldId
+    		csrf: null
         }, options );
     	
     	var wrapperId = this.attr('id');
@@ -23,6 +26,7 @@
 	    			data['qtiworks_presented_' + settings.responseUniqueId] = '1';
 	    			data['qtiworks_response_' + settings.responseUniqueId] = jQuery('#oo_' + settings.responseUniqueId).val();
 	    			data['no-response'] = 'oo-no-response';
+	    			data['_csrf'] = settings.csrf;
 
 	    			var targetUrl = jQuery('#' + settings.formName).attr("action");
 	    			jQuery.ajax(targetUrl,{
@@ -30,7 +34,7 @@
 	    				data: data,
 	    				cache: false,
 	    				dataType: 'json',
-	    				success: function(data, textStatus, jqXHR) {
+	    				success: function(responseData, textStatus, jqXHR) {
 	    					var now = new Date();
 	    					var hours = now.getHours();
 	    					var minutes = now.getMinutes()