{"action":"created","issue":{"url":"https://api.github.com/repos/expressjs/csurf/issues/53","labels_url":"https://api.github.com/repos/expressjs/csurf/issues/53/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/csurf/issues/53/comments","events_url":"https://api.github.com/repos/expressjs/csurf/issues/53/events","html_url":"https://github.com/expressjs/csurf/issues/53","id":57393049,"number":53,"title":"How to expire old csrf tokens?","user":{"login":"maplesap","id":10635318,"avatar_url":"https://avatars.githubusercontent.com/u/10635318?v=3","gravatar_id":"","url":"https://api.github.com/users/maplesap","html_url":"https://github.com/maplesap","followers_url":"https://api.github.com/users/maplesap/followers","following_url":"https://api.github.com/users/maplesap/following{/other_user}","gists_url":"https://api.github.com/users/maplesap/gists{/gist_id}","starred_url":"https://api.github.com/users/maplesap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maplesap/subscriptions","organizations_url":"https://api.github.com/users/maplesap/orgs","repos_url":"https://api.github.com/users/maplesap/repos","events_url":"https://api.github.com/users/maplesap/events{/privacy}","received_events_url":"https://api.github.com/users/maplesap/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/expressjs/csurf/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":{"login":"jonathanong","id":643505,"avatar_url":"https://avatars.githubusercontent.com/u/643505?v=3","gravatar_id":"","url":"https://api.github.com/users/jonathanong","html_url":"https://github.com/jonathanong","followers_url":"https://api.github.com/users/jonathanong/followers","following_url":"https://api.github.com/users/jonathanong/following{/other_user}","gists_url":"https://api.github.com/users/jonathanong/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathanong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathanong/subscriptions","organizations_url":"https://api.github.com/users/jonathanong/orgs","repos_url":"https://api.github.com/users/jonathanong/repos","events_url":"https://api.github.com/users/jonathanong/events{/privacy}","received_events_url":"https://api.github.com/users/jonathanong/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-02-11T23:16:55Z","updated_at":"2015-02-12T01:43:16Z","closed_at":null,"body":"In the document, the example given:\r\n\r\n```\r\n// pass the csrfToken to the view\r\napp.get('/form', function(req, res) {\r\n  res.render('send', { csrfToken: req.csrfToken() })\r\n})\r\n```\r\n\r\nShows that it will provide the form with a new csrf token whenever `/form` is requested.\r\n\r\nIf I refresh the form to get a new csrf token, but POST with the old csrf token, it won't throw a `403` error and will succeed.\r\n\r\nWould it be good practice to expire old tokens as soon as they are used? How can that be done with csurf?"},"comment":{"url":"https://api.github.com/repos/expressjs/csurf/issues/comments/74002664","html_url":"https://github.com/expressjs/csurf/issues/53#issuecomment-74002664","issue_url":"https://api.github.com/repos/expressjs/csurf/issues/53","id":74002664,"user":{"login":"jonathanong","id":643505,"avatar_url":"https://avatars.githubusercontent.com/u/643505?v=3","gravatar_id":"","url":"https://api.github.com/users/jonathanong","html_url":"https://github.com/jonathanong","followers_url":"https://api.github.com/users/jonathanong/followers","following_url":"https://api.github.com/users/jonathanong/following{/other_user}","gists_url":"https://api.github.com/users/jonathanong/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathanong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathanong/subscriptions","organizations_url":"https://api.github.com/users/jonathanong/orgs","repos_url":"https://api.github.com/users/jonathanong/repos","events_url":"https://api.github.com/users/jonathanong/events{/privacy}","received_events_url":"https://api.github.com/users/jonathanong/received_events","type":"User","site_admin":false},"created_at":"2015-02-12T01:43:16Z","updated_at":"2015-02-12T01:43:16Z","body":"@maplesap you want something different than CSRF, something more specific and requires a database in the backend. "}}