I've never run into this with News.YC, but yeah, that sort of behaviour is a hassle.
In fact, on our site I've just implemented a form key that's generated with each request (for CSRF prevention). But if you open a form in another tab then it'll generate a new form key and the first submit will fail. Similar problem to the News.YC closure problem ... hmmm.
Anyone else have experience with CSRF prevention and/or this issue? Is the best thing to do to keep a list of (say) the 10 most recent form keys in their session instead of just 1? They could theoretically open 11 tabs and then the first one would fail ... is there a better or safer solution?
Comments
I've never run into this with News.YC, but yeah, that sort of behaviour is a hassle.
In fact, on our site I've just implemented a form key that's generated with each request (for CSRF prevention). But if you open a form in another tab then it'll generate a new form key and the first submit will fail. Similar problem to the News.YC closure problem ... hmmm.
Anyone else have experience with CSRF prevention and/or this issue? Is the best thing to do to keep a list of (say) the 10 most recent form keys in their session instead of just 1? They could theoretically open 11 tabs and then the first one would fail ... is there a better or safer solution?