11

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience any usability issues like the browser Back button not working properly.

My question is, what would be a good time period before refreshing the user session token?

Improve this question
3
  • I would say around 20 minutes.
    – user43488
    Commented Apr 23, 2014 at 14:29
  • 1
    "I would say around 350 minutes", no, seriously @edvinas.me, why have you just selected that number? I believe that number is just out of the blue"...
    – kiBytes
    Commented Apr 23, 2014 at 14:32
  • Because 20 minutes is reasonable maximum amount of time for someone to fill most of the forms. My answer is of the same quality as the question.
    – user43488
    Commented Apr 23, 2014 at 14:49

2 Answers 2

Reset to default
13

My recommendation: Never.

You should only have one CSRF token per session. If the session times out, then the CSRF token expires at this point.

As there is no way for an attacker to read the CSRF token (at least there's no more of a risk of an attacker reading a CSRF token as the Session ID cookie), there is no need to generate a new one unless you have a new session to go with it.

Improve this answer
1

Well you should study your personal stats. You should ask yourself the following questions:

  1. How much time does an user spend in your system?
  2. What is the usability impact not changing it in a session?
  3. What is your expiring session time? ...

Nobody here can answer those questions (among others) better than yourself.

Improve this answer
1
  • 1
    Well it's a new service so I don't have those analytics yet and I need something safe to start off with.
    – Kid Diamond
    Commented Apr 23, 2014 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .