I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens.
A customer has questioned the fact that these tokens don't expire, and if captured will continue to be valid for a given user's session.
It is possible to customize add a timestamp to the token and validate it, thus expiring the issued token after a period.
What I'm wondering though, is this necessary? Should CSRF tokens provide replay protection? Wouldn't an attack require either MitM or an XSS vulnerability?
I sort of expect that a longish expiry is a reasonable part of a defense-in-depth strategy, but it is odd to me that replay would be raised as a security issue with an CSRF prevention scheme.
What am I missing?