Spring CSRF token life

Question

I am implementing CSRF protection using Spring security as per the doc

One question I have is: When this token will get invalidated by the Spring security? Does the token gets invalidated for each request submit?

Answer 1

By default the CSRF token is stored in the HTTP session and is generated on a per-session basis. See the official Spring Security documentation for more details. Therefore, the default lifecycle of CSRF tokens is the session duration.

Like everything else in Spring Security, the storage and retrieval of CSRF tokens can be customized to suit individual needs. The way to do that would involve creating an implementation for CsrfTokenRepository . Custom implementations could change the token on a per request basis, store the token in a relational database, and so on.