I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the CSRF protection. I spotted (the lack of) CSRF regeneration. All it does is extends the tokens life. This is making me very nervous. I played around with the expire times and I can not have it expire once a every two minutes. It would make my application unusable as it is mostly based on form submission.
My question is why would some one NOT want to have a token regenerate per request / per form?
Is this a best practice to maintain the same token? I've been reading OWASP and apart from the hidden fields in a form, other solutions are using CAPTCHA but then that would also break my application as the users do not want that. All in all I am just very confused as to why this is so.
Just for a little bit of extra information this is what I am doing to prevent any information leaks:
- SSL/TLS (https) through out the entire application
- Remove server signatures on headers
- set up a 64 Key encryption key for personal information, and the cookies
- Xss filter all post get cookie
- validate everything
- Escape anything that is derived from user inputted data.
and the following are my configurations for CI security :
$config['cookie_secure'] = TRUE; // Send cookies only over HTTPS $config['global_xss_filtering'] = TRUE; // Global xss filter (input only- i escape output when needed) $config['sess_encrypt_cookie'] = TRUE; // "encrypts" session with my 64 Character encryption key $config['sess_time_to_update'] = 10; // regenerate session id every 10 seconds
Sorry if this post is long and drawn out I just want to make sure that I am taking all the required steps into application security.