Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
1.1k views
in Technique[技术] by (71.8m points)

security - How long should the lifetime of a CSRF token be?

Should I have short lifetime for my CSRF token or can I have it last for the length of the session?

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

A CSRF token is not an access token and does not have a lifetime like bearer tokens do. They are generated using session information.

csrf_token = HMAC(session_token, application_secret)

CSRF adds additional information to your requests that lets the server verify the requests comes from an authorized location.

It only affects requests where the authorization info is sent automatically by the browser (cookie auth or basic/digest scheme)


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界,一个免费开放的程序员编程交流平台!开放,进步,分享!让技术改变生活,让极客改变未来! Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...