Hacker News new | past | comments | ask | show | jobs | submit login

Wouldn't you also need to regenerate CSRF tokens somehow so that the second submission doesn't reuse the initial CSRF token?



That wouldn't be a successful request... if the user gets an error from your application, they know to try again.

(Or more likely and more on-topic, for the offline-friendly form if the application gets the error first, the application could be smart enough to try again...)

The UUID doesn't guarantee anything other than capability to prevent duplicate records from duplicate submissions. Something else has to be responsible to make sure the submission is not abandoned without user input, unless a 200 or other successful status is received.


Depends on how often your CSRF tokens expire. For example, Django keeps the same token for the entire session by default IIRC.


There's no reason to expire CSRF tokens after each request.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: