Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
Bedrock Mission!

Learn more

View all

Sign in to view all badges

SOLVED

Why is the CSRF framework have a minimum value of 10 minutes?

Avatar

Level 1

The OOTB CSRF Framework has a minimum value of 10 minutes configured by default and cannot be reduced to below this value. What is the logic behind this limitation? Would it be possible for an attacker to use the csrf token to perform an attack.

1 Accepted Solution

Avatar

Correct answer by
Level 2

I just have an educated guess... See /etc.clientlibs/clientlibs/granite/jquery/granite.js:// refreshing csrf token periodically

setInterval(function() {

    getToken();

}, 300000);

This means that every 5 minutes the CSRF-Token gets refreshed in the Browser. So if you set the time below 10 minutes in the CSRFServlet there would be a risk that a valid Browser-Token is not valid anymore at backend. Values above 10 min are fine, because they will be refreshed every 5 min in the Browser.

View solution in original post

4 Replies

Avatar

Level 1

Yes, But WHY is it restricted to a minimum of 10 minutes?

Avatar

Level 10

We have asked the team if anyone can provide more infor on the 10 min default value.

Avatar

Correct answer by
Level 2

I just have an educated guess... See /etc.clientlibs/clientlibs/granite/jquery/granite.js:// refreshing csrf token periodically

setInterval(function() {

    getToken();

}, 300000);

This means that every 5 minutes the CSRF-Token gets refreshed in the Browser. So if you set the time below 10 minutes in the CSRFServlet there would be a risk that a valid Browser-Token is not valid anymore at backend. Values above 10 min are fine, because they will be refreshed every 5 min in the Browser.