# CSRF and expired session

**URL:** <https://discourse.laminas.dev/t/csrf-and-expired-session/1247>\
**Category:** Mezzio\
**Tags:** expressive, session\
**Created:** [November 12, 2019, 1:36pm UTC](https://discourse.laminas.dev/t/csrf-and-expired-session/1247 "2019-11-12T13:36:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jbelien](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/jbelien/32/251_2.png) [@jbelien](https://discourse.laminas.dev/u/jbelien)\
**Post date:** [November 12, 2019, 1:36pm UTC](https://discourse.laminas.dev/t/csrf-and-expired-session/1247/1 "2019-11-12T13:36:05Z")

</div>

Hello everyone,

I started using `zend-expressive-csrf` to protect my login page against CSRF following the documentation ([CSRF Guards](https://docs.zendframework.com/zend-expressive-csrf/guard/) and [CSRF Guard Middleware](https://docs.zendframework.com/zend-expressive-csrf/middleware/)).

It works (of course) really great except when the session expires between the load of the page and the submit of the form. For example, if a user opens the login page in a tab but don’t login and comes back some time later (when the session expired), the login “process” will fail.

What would be the best way to take care of that situation ?  
(increasing the time before session times out is, of course, not really a solution)

Thanks a lot ! 🙂

---

<div class="post-metadata">

**Author:** ![arueckauer](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/arueckauer/32/1105_2.png) [@arueckauer](https://discourse.laminas.dev/u/arueckauer)\
**Post date:** [November 12, 2019, 1:52pm UTC](https://discourse.laminas.dev/t/csrf-and-expired-session/1247/2 "2019-11-12T13:52:22Z")

</div>

Hello jbelien

I would say, everything works as expected. An expiring token is a feature.

> This token _expires_ after first submission or after a short amount of time, preventing replays or further submissions.

See [Introduction - zend-expressive-csrf - Zend Framework Docs](https://docs.zendframework.com/zend-expressive-csrf/intro/).

The user can always reload the page to get a new valid token. Not sure, if zend-expressive-csrf allows to configure how long a token is valid.

---

<div class="post-metadata">

**Author:** ![jbelien](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/jbelien/32/251_2.png) [@jbelien](https://discourse.laminas.dev/u/jbelien)\
**Post date:** [November 12, 2019, 2:02pm UTC](https://discourse.laminas.dev/t/csrf-and-expired-session/1247/3 "2019-11-12T14:02:49Z")

</div>

Yes, it indeed works as expected ! 🙂

I wasn’t really clear enough but I was wondering what would be a best practice (not a fix).

---

<div class="post-metadata">

**Author:** ![xtreamwayz](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/xtreamwayz/32/27_2.png) [@xtreamwayz](https://discourse.laminas.dev/u/xtreamwayz)\
**Post date:** [November 12, 2019, 2:56pm UTC](https://discourse.laminas.dev/t/csrf-and-expired-session/1247/4 "2019-11-12T14:56:11Z")

</div>

I don’t know if there is a best practice. What I would do is represent the form again and display a message that the token expired and ask the user to submit the form again.

---

<div class="post-metadata">

**Author:** ![jbelien](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/jbelien/32/251_2.png) [@jbelien](https://discourse.laminas.dev/u/jbelien)\
**Post date:** [November 12, 2019, 3:11pm UTC](https://discourse.laminas.dev/t/csrf-and-expired-session/1247/5 "2019-11-12T15:11:30Z")

</div>

Yeah, that seems indeed the most logical and that’s what I did.  
I guess I’m “_far-fetching_” this … 😆

Thanks for your feedback !