Ramaze/ramaze — Issue #31: CSRF tokens and multiple tabs/windows
Author: YorickPeterse
Created: 2012-02-16 19:32:16+00:00
State: open
Labels: Enhancement

The current implementation of the CSRF helper makes it impossible for users to
use the same application and user account in multiple tabs or windows. This is
because the helper generates a new token on each successful request.

The problem with this is that if the user reloads the page in tab/window A the
token in tab/window B is no longer valid, thus any requests to actions that
require a valid CSRF token will fail.

If possible tokens should be bound to a window or tab, otherwise I think the
only alternative is to remove the process of generating new tokens on valid
requests. However, the latter would lower the security of the helper and thus I
think it's something we should only do as a last resort.