How long should the CSRF token last?

Question

Should I have a short lifetime for my CSRF token or can I use it for the duration of the session?

Answer 1

A CSRF token is not an access token and does not have bearer tokens. They are generated using session information.

csrf_token = HMAC(session_token, application_secret)

CSRF adds additional information to your requests, which allows the server to verify that the requests come from an authorized location.

It only affects requests in which authorization information is automatically sent by the browser (cookie auth or basic / digest scheme)