Modes

Token  Type

Stateless  CSRF  Token  Validation

HMAC

Token  Scope

Token  Life

per  Site per  Configured  Time

per  URL per  Form Double  Submit  Cookie

per  Configured  Time

per  Site per  URL

per  Configured  Time

per  Form

Stateful  CSRF  Token  Validation

Initial  Goal  (current  project) Subsequent  Goal

Secure  Random  String

Notes

per  Site per  URL

per  Session

per  Form

per  Session

1.  There  is  no  per  Session  option  as  we  are  not  hooking  into  the  session  storage   mechanism  with  this  protection  mode. 2.  There  is  no  One  Time  Use  option,  however  close  to  one  time  use  could  be   achieved  with  a  limited  expiration  window.  

1.  There  will  be  no  per  Session  option  as  we  are  not  hooking  into  the  session   storage  mechanism  with  this  protection  mode. 2.  There  will  be  no  One  Time  Use  option,  however  close  to  one  time  use  could  be   achieved  with  a  limited  expiration  window.  

1.  We  don't  think  per  Site  One  Time  Use  should  be  compatible  options  due  to  high   likelihood  of  it  breaking  applications. per  Configured  Time 2.  Getting  the  per  Configured  Time  option  to  work  reliably  given  current  project   budget  will  be  a  challenge  because  of  the  complexities  involved  in  getting  it  to   work  reliably. One  Time  Use N/A One  Time  Use