32

Do we have to generate a token, for every form in a website? I mean, every-time to generate different token for every requested form? If not, why?

1

2 Answers 2

43

In general, it suffices to have just one token per session, a so called per-session token:

In general, developers need only generate this token once for the current session. After initial generation of this token, the value is stored in the session and is utilized for each subsequent request until the session expires.

If you want to further enhance the security, you can use one token per each form/URL (per-form token) to mitigate the impact when one token leaks (e. g. XSS) as an attacker would only be able to successfully attack that specific form/URL.

But using per-request tokens, i. e. tokens that change with each request, rather cuts the usability of the website as it restricts parallel browsing:

To further enhance the security of this proposed design, consider randomizing the CSRF token […] for each request. Implementing this approach results in the generation of per-request tokens as opposed to per-session tokens. Note, however, that this may result in usability concerns. For example, the "Back" button browser capability is often hindered as the previous page may contain a token that is no longer valid. Interaction with this previous page will result in a CSRF false positive security event at the server.

So I recommend you to use either per-session tokens or per-form tokens.

5
  • I think per form tokens would work if: a) You only create the token when the user first loads the form, any subsequent form loads should re-use the first token for that form. b) When storing the token in the session it should include an identifier for the specific page/form. E.g. SESSION['edit-user-csrf'] and SESSION['edit-order-csrf'] and that way you can open up a different page in a different tab and the two forms can still be submitted successfully as the session is storing both tokens (one for each form). The page knows which csrf token to check and use because it's on that page.
    – zuallauz
    Commented Feb 24, 2012 at 11:41
  • Make sure you have Inactivity and Absolute session times that require re-authentication and new token generation. (Example: 20 minutes of inactivity or 4 hours absolute)
    – LaJmOn
    Commented Mar 2, 2012 at 15:06
  • @zuallauz The form’s URL can be used to identify the form. If that doesn’t suffice, you can add any other identifying information (e. g. hidden input values) to it or, even better, use a form container to store the hidden input values into that will also prevent spoofing of hidden input values.
    – Gumbo
    Commented Mar 2, 2012 at 17:54
  • 2
    @LaJmOn That is not necessary. You should choose an algorithm that generates tokens with sufficient entropy that will make guessing a valid token not impracticable. Regenerating the token will only annoy the users.
    – Gumbo
    Commented Mar 2, 2012 at 17:58
  • If using proper XSS one can usually leak any token in site - you can make AJAX/iframe GET call in XSS to form page and post the form with your intended values. Commented Jan 3, 2013 at 0:29
14

No, you just need to generate a token on a per-session basis.

Tokens are very unlikely to be leaked accidentally by users and generating a token per form makes things very complicated if a user is browsing the site in two different tabs/windows at once.

1
  • Thanks. So, the token still will be placed in every form (but just per-session token not different)?
    – Centurion
    Commented Dec 28, 2011 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.