Invalidate CSRF Token | Community
Skip to main content
divyav15815834
divyav15815834
Level 2
July 8, 2020
Solved

Invalidate CSRF Token

  • July 8, 2020
  • 2 replies
  • 1575 views

Hi,

 

We know currently CSRF token has expiration set to 10 mins and token is generated every 5 minutes.

 

We have a requirement wherein they do not want the "CSRF Token" submitted on the POST request to be used again. In scenarios where we have multiple steps(POST requests) in a flow or when you try to replay the XHR request, it uses the same CSRF token for every form submit.

Is there any way we can invalidate the CSRF token once it is used and regenerate a new one for the subsequent requests?

 

Thanks,

Divya

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Vaibhavi_J

Hi @divyav15815834 ,

 

As you have mentioned expiration set to 10 mins and token is generated every 5 minutes.

It is not recommended to update OOTB CSRF functionality. 

 

We can find the CSRF token in below path:

/libs/granite/csrf/token.json

Also, default script CSRF is available in below path:

/libs/clientlibs/granite/jquery/granite/csrf/source/csrf.js

 

Both are internal area and the adobe does not recommend to override.

 

An alternative solution would be:

You can disable the CSRF token generation by initializing empty window.Granite.csrf variable wherever is not necessary if you are implementing custom CSRF.

Below piece of script help in disabling the CSRF token generation:

<script type="text/javascript">
    window.Granite = window.Granite || {};
    window.Granite.csrf = {
    initialised: true
};
</script>

Please do consider the security checklist into consideration.

 

 

 

2 replies

Vaibhavi_J
Vaibhavi_JAccepted solution
Level 7
July 8, 2020

Hi @divyav15815834 ,

 

As you have mentioned expiration set to 10 mins and token is generated every 5 minutes.

It is not recommended to update OOTB CSRF functionality. 

 

We can find the CSRF token in below path:

/libs/granite/csrf/token.json

Also, default script CSRF is available in below path:

/libs/clientlibs/granite/jquery/granite/csrf/source/csrf.js

 

Both are internal area and the adobe does not recommend to override.

 

An alternative solution would be:

You can disable the CSRF token generation by initializing empty window.Granite.csrf variable wherever is not necessary if you are implementing custom CSRF.

Below piece of script help in disabling the CSRF token generation:

<script type="text/javascript">
    window.Granite = window.Granite || {};
    window.Granite.csrf = {
    initialised: true
};
</script>

Please do consider the security checklist into consideration.

 

 

 

    ChitraMadan
    Community Advisor
    ChitraMadanCommunity Advisor
    Community Advisor
    July 9, 2020

    Hi @divyav15815834,

     

    May be first try to set a very low expiration time and see the impact on your application.

     

    I am not sure what exactly is your use case but invalidating token on every request can cause usability issues.

      Terms & ConditionsAccessibility statement

      Loading footer...