I'm trying to prevent CSRF for my site.
I'm using this method: http://codeutopia.net/blog/2008/10/16/how-to-csrf-protect-all-your-forms/
Why must the security key be changed every time a page is generated?
The user wouldn't be able to use multiple forms (in multiple tabs) and submit them simultaneously
Can't the key be generated once upon login, then stored in session cookie, and be used throughout all requests?
For example
Or does this not work against CSRF at all?
I'm using this method: http://codeutopia.net/blog/2008/10/16/how-to-csrf-protect-all-your-forms/
Why must the security key be changed every time a page is generated?
The user wouldn't be able to use multiple forms (in multiple tabs) and submit them simultaneously
Can't the key be generated once upon login, then stored in session cookie, and be used throughout all requests?
For example
<form action="this.php" method="post"> <input type="hidden" name="csrf" value="<? GET KEY FROM SESSION ?>" /> <!-- Stuff here --> </form>
Or does this not work against CSRF at all?