EllisLab/CodeIgniter — Issue #843: CSRF regenerating token on every submission
Author: RS71
Created: 2011-12-27 16:10:32+00:00
State: open

The current CSRF implementation (single-stored token regenerated on every submission) is overly strict and creates usability problems with multiple tabs and back/forward navigation. (things like creating multiple 'products' in tabs, back navigation on validation error, asynchronous file uploads in a form, etc end up being a hassle)

There should be an option to set the level of strictness - something like an optional multi-token approach (expiring by age and/or number of tokens issued) or at least an option to turn off token regeneration on form submission.

Useful links:

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

http://stackoverflow.com/questions/2695153/php-csrf-how-to-make-it-works-in-all-tabs