How long should the lifetime of a CSRF token be?

Question

Should I have short lifetime for my CSRF token or can I have it last for the length of the session?

Answer 1

A CSRF token is not an access token and does not have a lifetime like bearer tokens do. They are generated using session information.

csrf_token = HMAC(session_token, application_secret)

CSRF adds additional information to your requests that lets the server verify the requests comes from an authorized location.

It only affects requests where the authorization info is sent automatically by the browser (cookie auth or basic/digest scheme)