Forum Discussion

Jesus_Rodrigue2's avatar
Jesus_Rodrigue2
Icon for Nimbostratus rankNimbostratus
Oct 01, 2014

ASM CSRF Expiration Time token

Hello

 

I have recently implemented CSRF protection on few web based applications, so far so good but now I would like to enable expiration-time on the token so that it will be renewed every x seconds . What do you think is a good value for the expiration time? 1s, 10 s , 120 s ? Ideally it would be great to get it renewed every request but there is no such option so I am wondering if it is safe to set it up to 10s

 

Many thanks

 

ASM Advanced WAF
BIG-IQ
security

1 Reply

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Nov 17, 2014

    i don't believe it works quite like that. it is the time the cookie is valid for after the page has been send, else you get an event that it isn't valid and you have to submit the request again ( i believe that means reloading the page ).

     

    so i wouldn't set it too low because your users will get blocked requests.