I've get CSRF token from url /rest/session/token. After have CSRF token, I can send request (get, post) to API and working fine. But after time, when I send request. It's doesn't work. I'm getting error permission denies. I think maybe CSRF token expire time. So I want know time life of CSRF token. And how to change time life of CSRF token.

  • Isn't CSRF token generated based on session and path(ie. "static" / unique per user and path)?
    – user21641
    Jun 16, 2017 at 4:08
  • I'm create token for user when they first login. And stored value at browser. But after time I can't pass get, post requrest (require permission)
    – Jonh
    Jun 16, 2017 at 4:32
  • See \Drupal\Core\Access\CsrfTokenGenerator::get and \Drupal\Core\Session\MetadataBag::__construct it looks like your session is expired(or the metadata to be more precise, there is 180 second value set, if I understood it correctly).
    – user21641
    Jun 16, 2017 at 6:54
  • @IvanJaros thanks for help. But i don't think that.
    – Jonh
    Jun 16, 2017 at 8:02
  • The answer below is the way to go, but just out of curiosity, does anyone know what the token lifetime is?
    – aalaap
    Oct 31, 2017 at 6:52

1 Answer 1


This is the same question I had asked myself and I wanted to increase the lifetime to something like 6 hours.

However, the point behind CSRF tokens is that they change frequently so that nobody can try to steal one of those tokens and then use it to make a forged request. Here's the workflow I ended up using in my application:

  • Request a CSRF token.
  • Use the token to make requests.
  • If the request fails because the token has expired, go to step 1.

Hope it helps. Happy coding.

  • This is a better solution than changing the token lifetime, so it should be the accepted answer.
    – aalaap
    Oct 31, 2017 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.