Implement token time-outs

[phpgt]

Implement token time-outs

[g105b]

Keep it configurable, but by default I don't see a problem having a very long timeout. The problem with sessions is that they could go on indefinitely for people like me who don't ever close their browser.

2 or 3 hours doesn't seem like it would be a problem. I can see pages waiting to be submitted for over an hour - I do it some times with government/accounting forms.

[j4m3s]

I've been stewing on this... And even started coding a solution... But I've concluded it's a dumb idea.

A 64 char+digit token means there are 4e99 possible combinations of token. Even if there were a million valid tokens floating around for a user, it would still mean the chance of bluffing a valid token would be 1 in 4e93. On average it would therefore take 6e79 years of trying one million tokens per second to succeed in a csrf attempt. Not really a valid problem.

However, this does prompt a much more valid potential issue - the memory or capacity impact of lots and lots of valid tokens kicking around on a busy site.

@g105b if you agree please can you close this ticket? I'll raise a new one for limiting the memory footprint for busy sites. That will take some discussion...

[g105b]

I do agree! Good thinking - there was an issue in there somewhere, but it turned out to be a different one.