Quantcast
Channel: Programming Forums
Viewing all articles
Browse latest Browse all 51036

CSRF session key expiry

$
0
0
I'm trying to prevent CSRF for my site.

I'm using this method: http://codeutopia.net/blog/2008/10/16/how-to-csrf-protect-all-your-forms/

Why must the security key be changed every time a page is generated?
The user wouldn't be able to use multiple forms (in multiple tabs) and submit them simultaneously

Can't the key be generated once upon login, then stored in session cookie, and be used throughout all requests?

For example

<form action="this.php" method="post">
<input type="hidden" name="csrf" value="<? GET KEY FROM SESSION ?>" />
&lt!-- Stuff here -->
</form>



Or does this not work against CSRF at all?

Viewing all articles
Browse latest Browse all 51036

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>