does anyone know the TTL on the

CSRFGenerateToken()

? is it rotated frequently or alive for the whole session till that resets? I couldn't find any information on that part.

Given it stores the value in session, I'm guessing it stays there until replaced or the session expires..? Don't know certain though, sorry.

thanks.. that's what i'm trying to figure out. i personally don't want it to live the full session because a bot could increase the session timeout by accessing with a valid token.. therefore keeping it "alive" per say.

To do that, wouldn't the bot already need to know an authenticated user's cfid/cftoken cookie values, at which point you're pretty much fucked anyhow?

good point

I would invest some time reading the material online about CRSF attacks (the wiki article gets there eventually), and understand the vector. I think what CFML provides makes sense out of the box. "for this request to work, you need to pass [this] token. And to know [this] token, you need to receive it". Last time I was involved in tightening a site for CRSF vulns, am pretty sure this all worked fine for us. @Mark Drew (he/him) might remember better: he did the actual leg work (@ HB, years ago).

No, its only for the request of that form