Search code examples
sessioncsrfcherrypy

csrf token invalid when user's session times out

Used this flask example for implementing a csrf token in my cherrypy app for all my site's forms...

flask csrf token example

However when a user's session times out the csrf token in session becomes None.

token = cherrypy.session.get('csrf_token')
if token is None or token != cherrypy.request.params['csrf_token']:
    raise cherrypy.HTTPError(403)

How can I work around this?

Thanks in advance!

Solution

  • There is not need to work around this, as the behaviour you are describing is correct. If the csrf token persists for a long time, it is not very useful - the whole idea is that it is not reusable, at least not over a long period of time.