Is CSRF token encryption protected against a BREACH attack?

Question

OWASP Encrypt Pattern Token Pattern is a CSRF protection solution where the value of the token is a function of time. Does this mean that the Encrypted Token Pattern has built-in BREACH attack protection ?

Answer 1

As a rule, no, since in most implementations the token is generated only once for authentication (i.e. when someone logs in to the system). In general, it is recommended that you only generate the CSRF token once per session.

, CSRF BREACH, . , , .

, BREACH, .

. , , HTTP-, referer , . HTTP- HTTPS-, .