4 ms·
I think parent was referring to the session cookie. The linked article mentions putting the generated token into the server side user session and then to valida
by mgliwka 5y ago
I think parent was referring to the session cookie. The linked article mentions putting the generated token into the server side user session and then to validate it on the next request. You might need a session cookie for that.
- onion2k 5y agoSession cookies persist for the length of the session. That's still too long for a CSRF token. You should be generating a new one in every request that needs a token in the response.