Multiple csrftoken cookies, is it a RFC requirement to only have 1 csrftoken?

Question

I'm trying to find an answer to the following.

• Under what circumstances would the browser store multiple csrftoken cookies?
• Is it the correct, or technically valid functionality?
• And where in the RFC/security documentation passing an array, or trying an array of csrftoken exists, or is technically valid?

I've attached an example screenshot of what I'm seeing multiple csrftoken with various cookie paths, and expiry times ( multitenancy, and various form paths ).

Related:

• https://github.com/django/django/blob/5a68f024987e6d16c2626a31bf653a2edddea579/django/middleware/csrf.py#L324
• https://github.com/django/django/blob/5a68f024987e6d16c2626a31bf653a2edddea579/django/middleware/csrf.py#L191
• Cookie path and its accessibility to subfolder pages

Answer 1

It is not a requirement to only have one token, but a more common approach would be to update/refresh CSRF token cookie on a single root path: /.

It really depends how your server interprets the potential forms posts that follow each token request. An easy approach is to store a newly generated token on a user's session storage (in memory or database) before setting the cookie. Then compare these two again on the server when the user's form POST arrives.

1. The browser stores multiple token cookies when each HTTP GET request (which responds with a token) specifies a custom cookie path. A more common approach would be to have one cookie for the purpose of protecting against CSRF.

2. You could make your tokens path specific, but this would not make your token more secure.

3. Testing token validity is entirely up to you.

Hope this helps.