使用npm csurf时，是否应该可以在同一会话中重复使用csrf令牌？

Question

When using csurf I've noticed that if I present a previously generated and used csrf token, it is still accepted as a valid token (within the same session).

Should this be the case or am I using it wrong? I would have expected a used csrf token to become invalidated (so it can only be used once per session id).

My code looks something like this:

var express = require('express');
var bodyParser = require('body-parser');
var csurf = require('csurf');
app.use(csurf());
app.use(function (req, res, next) {
  res.locals.csrfToken = req.csrfToken();
  next();
}); 

Answer 1

According to OWASP : "Synchronizer (CSRF) Tokens (are) Unique per user session" which I take to mean that they are tied to the session . This means that it is possible to re-use a token from the same session. Hence the answer to the question is 'yes'.

It seems then that npm csurf is using a standard best practice by allowing the re-use of csrf tokens within the same session (even after they have been consumed once).

Relevant part from OWASP:

Synchronizer (CSRF) Tokens

Any state changing operation requires a secure random token (eg, CSRF token) to prevent CSRF attacks

Characteristics of a CSRF Token

• Unique per user session
• Large random value
• Generated by a cryptographically secure random number generator

The CSRF token is added as a hidden field for forms or within the URL if the state changing operation occurs via a GET The server rejects the requested action if the CSRF token fails validation