As far as I understand there are two approaches to perform CSRF protection:
1) CSRF token per session - the token is generated once per session. This is the easiest way;
2) CSRF token per request - the new token is generated on each request, and the old one becomes invalid. This is more secure but the webapp might be broken when tabbing and clicking "back" button in the browser.
A few days ago I started to analyze how Node.js Connect framework implements CSRF protection and noticed that it uses the third approach:
New CSRF token is generated on each request, but the old one doesn't become invalid. So there are multiple valid CSRF tokens for the user at once.
My question is: What are advantages of multiple valid CSRF tokens?
Thank you very much.
P.S. I'm not very strong in English so please explain as simply as possible. Thank you again
EDIT (rephrasing my question):
The main benefit of generating new token on each request (and making old one invalid) is that token becomes short term and even if attacker steals the token, it will expire very fast. But with Connect an old token doesn't expire, which makes this approach the same as using single token per session.
So why did Connect developers decide to generate a new token on each request? Am I missing something?