News for hackers. Stuff that matters.

A comment on Ask HN: What kinds of cookies are “required” for a website to function?. Parent comment

Re:Ask HN: What kinds of cookies are “required” for a websit... by mgliwka on Thursday April 08, 2021 @04:20AM (#26736337)
I think parent was referring to the session cookie. The linked article mentions putting the generated token into the server side user session and then to validate it on the next request. You might need a session cookie for that.
[ Parent | on HN ]
Re:Ask HN: What kinds of cookies are “required” for a websit... by onion2k on Thursday April 08, 2021 @04:25AM (#26736375)
Session cookies persist for the length of the session. That's still too long for a CSRF token. You should be generating a new one in every request that needs a token in the response.
[ Parent | on HN ]