# Timeout options for mezzio-csrf

**URL:** <https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916>\
**Category:** Mezzio\
**Tags:** mezzio-csrf\
**Created:** [June 10, 2022, 9:13am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916 "2022-06-10T09:13:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kriss\_Kals](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/kriss_kals/32/1295_2.png) [@Kriss\_Kals](https://discourse.laminas.dev/u/Kriss_Kals)\
**Post date:** [June 10, 2022, 9:13am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916/1 "2022-06-10T09:13:18Z")

</div>

Hello,

is it possible to set a timeout for mezzio-csrf? I did not find a use case in the documentation.

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [June 10, 2022, 10:20am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916/2 "2022-06-10T10:20:40Z")

</div>

If you use [mezzio-session-ext](https://docs.mezzio.dev/mezzio-session-ext/intro/) then the ini settings can help:

> <https://github.com/mezzio/mezzio-session-ext/blob/baf214e4209bc67a181d15e3bb6d1c89e46906b4/src/PhpSessionPersistence.php#L76-L91>

Otherwise, please describe where exactly you want to set the timeout.

---

<div class="post-metadata">

**Author:** ![Kriss\_Kals](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/kriss_kals/32/1295_2.png) [@Kriss\_Kals](https://discourse.laminas.dev/u/Kriss_Kals)\
**Post date:** [June 10, 2022, 11:01am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916/3 "2022-06-10T11:01:05Z")

</div>

I would like to set an expiration time for a form, e.g. login. After submitting the form after the time I would like to return an error to the user. In laminasa this could be done by setting a variable for CSRF. For example:

```auto
$this->add([
			'name' => 'login_csrf',
			'type' => Element\Csrf::class,
			'options' => [
				'salt' => 'unique',
				'timeout' => 180
			],
			'attributes' => [
				'id' => 'login_csrf'
			]
		]);

```

And finally you could return an error ( Csrf::NOT\_SAME ) through the validator…

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [June 10, 2022, 11:29am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916/4 "2022-06-10T11:29:14Z")

</div>

See in the documentation of laminas-form, there will you find the correct option keys:

```php
use Laminas\Form\Element;
use Laminas\Form\Form;

$form = new Form('my-form');
$form->add([
    'type' => Element\Csrf::class,
    'name' => 'csrf',
    'options' => [
        'csrf_options' => [
            'timeout' => 600,
        ],
    ],
]);

```

> **[CSRF - laminas-form - Laminas Docs](https://docs.laminas.dev/laminas-form/v3/element/csrf/#basic-usage)**
>
> Validate and display simple and complex forms, casting forms to business objects and vice versa.

This will set the options for the underlying CSRF validator:

> **[Csrf - laminas-validator - Laminas Docs](https://docs.laminas.dev/laminas-validator/validators/csrf/#supported-options)**
>
> Validation classes for a wide range of domains, and the ability to chain validators to create complex validation criteria.

---

<div class="post-metadata">

**Author:** ![Kriss\_Kals](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/kriss_kals/32/1295_2.png) [@Kriss\_Kals](https://discourse.laminas.dev/u/Kriss_Kals)\
**Post date:** [June 10, 2022, 11:42am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916/5 "2022-06-10T11:42:22Z")

</div>

We misunderstood each other. According to the recommendations in the mezzio project, you should not use laminas-session if you are using mezzio-session and mezzio-session-ext, which is what laminas validator csrf - laminas-session requires:

> **[Csrf - laminas-validator - Laminas Docs](https://docs.laminas.dev/laminas-validator/validators/csrf/#supported-options)**
>
> Validation classes for a wide range of domains, and the ability to chain validators to create complex validation criteria.

My question is about setting the timeout option for mezzio-csrf.

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [June 10, 2022, 11:52am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916/6 "2022-06-10T11:52:16Z")

</div>

> [@Kriss\_Kals](#):
>
> which is what laminas validator csrf - laminas-session requires:

This means that you cannot use the CSRF element of laminas-form like this. You must set a custom CSRF validator to the form element.

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [June 10, 2022, 11:54am UTC](https://discourse.laminas.dev/t/timeout-options-for-mezzio-csrf/2916/7 "2022-06-10T11:54:36Z")

</div>

Instead of the form element, use the middleware of mezzio-csrf.