Ramaze/ramaze — Issue #27: Regenerate CSRF tokens on valid requests
Author: YorickPeterse
Created: 2012-01-13 10:00:42+00:00
State: open
Labels: Enhancement

The current implementation of the CSRF helper has an annoying flaw: regardless
of whether any valid requests are executed the token will always expire after 15
minutes. This can get very annoying if you're about to submit a form and all of
a sudden your token is expired, this will most likely cause the form submission
to fail (depending on how applications handle invalid requests).

To work around this the token should be re-generated on each valid request.
Doing so means the token will only expire if the user is actually idle for at
least 15 minutes.