I've get CSRF token from url /rest/session/token. After have CSRF token, I can send request (get, post) to API and working fine. But after time, when I send request. It's doesn't work. I'm getting error permission denies. I think maybe CSRF token expire time. So I want know time life of CSRF token. And how to change time life of CSRF token.
5
-
Isn't CSRF token generated based on session and path(ie. "static" / unique per user and path)?– user21641Jun 16, 2017 at 4:08
-
I'm create token for user when they first login. And stored value at browser. But after time I can't pass get, post requrest (require permission)– JonhJun 16, 2017 at 4:32
-
See \Drupal\Core\Access\CsrfTokenGenerator::get and \Drupal\Core\Session\MetadataBag::__construct it looks like your session is expired(or the metadata to be more precise, there is 180 second value set, if I understood it correctly).– user21641Jun 16, 2017 at 6:54
-
@IvanJaros thanks for help. But i don't think that.– JonhJun 16, 2017 at 8:02
-
The answer below is the way to go, but just out of curiosity, does anyone know what the token lifetime is?– aalaapOct 31, 2017 at 6:52
Add a comment
|
1 Answer
This is the same question I had asked myself and I wanted to increase the lifetime to something like 6 hours.
However, the point behind CSRF tokens is that they change frequently so that nobody can try to steal one of those tokens and then use it to make a forged request. Here's the workflow I ended up using in my application:
- Request a CSRF token.
- Use the token to make requests.
- If the request fails because the token has expired, go to step 1.
Hope it helps. Happy coding.
-
This is a better solution than changing the token lifetime, so it should be the accepted answer.– aalaapOct 31, 2017 at 6:45