3 ms·

I don't think an attacker can influence my ACTION attribute, but just in case, I use only 4 characters from my session token (1MM combinations). I don't think C

by brlewis 16y ago

I don't think an attacker can influence my ACTION attribute, but just in case, I use only 4 characters from my session token (1MM combinations). I don't think CSRF tokens are easy to brute-force, so that should be long enough. I don't like keeping per-request state on the server, else I would use random CSRF tokens.

tptacek 16y ago
It doesn't need to be per-request; it can just be another 128 bit random number, stored in the session, re-used for every request.