facebook/tornado — Issue #462: feature request: ability to set _xsrf cookie expiration
Author: tzuryby
Created: 2012-02-17 08:37:23+00:00
State: open

I wanted to be able to set `_xsrf` expiration to 1 day rather than current 30 days.
I have search the code to see where this happens and found this.

```
@property
def xsrf_token(self):
"""The XSRF-prevention token for the current user/session.

To prevent cross-site request forgery, we set an '_xsrf' cookie
and include the same '_xsrf' value as an argument with all POST
requests. If the two do not match, we reject the form submission
as a potential forgery.

See http://en.wikipedia.org/wiki/Cross-site_request_forgery
"""
if not hasattr(self, "_xsrf_token"):
token = self.get_cookie("_xsrf")
if not token:
token = binascii.b2a_hex(uuid.uuid4().bytes)
expires_days = 30 if self.current_user else None
self.set_cookie("_xsrf", token, expires_days=expires_days)
self._xsrf_token = token
return self._xsrf_token
```

So I wonder if there was a way to do so easily, e.g.

`define("xsrf_cookie_expiration", default=1, help="_xsrf cookie expiration days", type=int)`

and within the `xsrf_token` implementation:
`expires_days = options.xsrf_cookie_expiration if self.current_user else None`