I'm implementing CSRF protection using the Encrypted Token Pattern (as per https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Encrypted_Token_Pattern).
I understand that the 2 main differences between that pattern and the Double Submit Cookie Pattern are: 1. the token itself is an encrypted token, with expiration 2. the token is stored not in cookie, but instead in DOM element or JS variable (through minified, obfuscated external JS file).
I also understand that just as other prevention methods, this one as well is not safe if your site is vulnerable for XSS attacks.
my questions are: 1. what would be the recommended expiration to give to the token? for example if my site session lasts 12 hours, would it be OK to set expiration of 1 hour, or is it recommended to be limited to minutes/seconds? 2. how do you handle expiration from UX perspective, in case the expiration is short? for example - if the page was loaded at 0sec, but the action was submitted by the user at 80sec and the expiration is 60sec - the submitted token would be expired and the action would fail.