I have a CSRF Token on the login page, which works as expected. So when user has the login page open for a long time (the token has expired in the background). When they enter their login credentials correctly, it tells them that the action is invalid because the token has expired and redirects them to login page again, where they can now successfully enter.

I think the behavior is as expected, because the CSRF token has become stale and an explicit action has fetched the correct token. The users hate it because they need to enter the login information twice.

ANy advice? This seems like a very common problem with CSRF on a login page that sits there for a long time..

Thanks and appreciate any help.

  • 1
    Increase the lifetime or fetch new ones via AJAX. I am not really sure what you are asking.
    – marstato
    Commented Mar 25, 2016 at 0:35
  • you could automatically refresh the login page once every x minutes using javascript.
    – Jacco
    Commented Mar 25, 2016 at 7:43

1 Answer 1


Option 1) Make the login a two page operation. Username on first page, password on next. There's no need to have CSRF protection on the username page. Users will understand a timeout on the password page.

Option 2) Have some JavaScript that displays a countdown if the page is open too long. If the timeout occurs, disable the login form and put a notice telling the user to refresh before continuing.

  • 1
    See stackoverflow.com/a/15350123/14731 for why you might need CSRF tokens on the login page.
    – Gili
    Commented Mar 26, 2016 at 12:07
  • @Gili exactly. That's why you must keep CSRF on the second login page that has the password. The actual login operation must be protected. It's just the username page that can skip the CSRF protection Commented Mar 26, 2016 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .