{"action":"created","issue":{"url":"https://api.github.com/repos/elixir-lang/plug/issues/176","labels_url":"https://api.github.com/repos/elixir-lang/plug/issues/176/labels{/name}","comments_url":"https://api.github.com/repos/elixir-lang/plug/issues/176/comments","events_url":"https://api.github.com/repos/elixir-lang/plug/issues/176/events","html_url":"https://github.com/elixir-lang/plug/issues/176","id":55556804,"number":176,"title":"CSRF plug should generate new tokens on every request","user":{"login":"yrashk","id":452,"avatar_url":"https://avatars.githubusercontent.com/u/452?v=3","gravatar_id":"","url":"https://api.github.com/users/yrashk","html_url":"https://github.com/yrashk","followers_url":"https://api.github.com/users/yrashk/followers","following_url":"https://api.github.com/users/yrashk/following{/other_user}","gists_url":"https://api.github.com/users/yrashk/gists{/gist_id}","starred_url":"https://api.github.com/users/yrashk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yrashk/subscriptions","organizations_url":"https://api.github.com/users/yrashk/orgs","repos_url":"https://api.github.com/users/yrashk/repos","events_url":"https://api.github.com/users/yrashk/events{/privacy}","received_events_url":"https://api.github.com/users/yrashk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-01-27T00:06:37Z","updated_at":"2015-01-27T08:37:56Z","closed_at":"2015-01-27T08:34:49Z","body":"If I understand the code correctly (it's too early here so I might have missed something), this https://github.com/elixir-lang/plug/blob/master/lib/plug/csrf_protection.ex#L114-L115 basically means that CSRF tokens generated by Plug are \"almost-lifetime\", which kind of defeats the purpose (see http://stackoverflow.com/questions/10466241/new-csrf-token-per-request-or-not)\r\n\r\nShouldn't we always generate a new token and put it into the response cookie?\r\n\r\nP.S. Happy to do a PR if neccessary."},"comment":{"url":"https://api.github.com/repos/elixir-lang/plug/issues/comments/71609423","html_url":"https://github.com/elixir-lang/plug/issues/176#issuecomment-71609423","issue_url":"https://api.github.com/repos/elixir-lang/plug/issues/176","id":71609423,"user":{"login":"josevalim","id":9582,"avatar_url":"https://avatars.githubusercontent.com/u/9582?v=3","gravatar_id":"","url":"https://api.github.com/users/josevalim","html_url":"https://github.com/josevalim","followers_url":"https://api.github.com/users/josevalim/followers","following_url":"https://api.github.com/users/josevalim/following{/other_user}","gists_url":"https://api.github.com/users/josevalim/gists{/gist_id}","starred_url":"https://api.github.com/users/josevalim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josevalim/subscriptions","organizations_url":"https://api.github.com/users/josevalim/orgs","repos_url":"https://api.github.com/users/josevalim/repos","events_url":"https://api.github.com/users/josevalim/events{/privacy}","received_events_url":"https://api.github.com/users/josevalim/received_events","type":"User","site_admin":false},"created_at":"2015-01-27T08:37:56Z","updated_at":"2015-01-27T08:37:56Z","body":"How is it fine? The cookie is still shared across all tabs. Once you open the second tab and get a new token, the cookie in the previous tab will be overwritten."}}