security - CSRF protection: do we have to generate a token for every form? -

do have generate token, every form in website? mean, every-time generate different token every requested form? if not, why?

in general, suffices have one token per session, called per-session token:

in general, developers need generate token once current session. after initial generation of token, value stored in session , utilized each subsequent request until session expires.

if want further enhance security, can use 1 token per each form/url (per-form token) mitigate impact when 1 token leaks (e. g. xss) attacker able attack specific form/url.

but using per-request tokens, i. e. tokens change each request, rather cuts usability of website restricts parallel browsing:

to further enhance security of proposed design, consider randomizing csrf token […] each request. implementing approach results in generation of per-request tokens opposed per-session tokens. note, however, may result in usability concerns. example, "back" button browser capability hindered previous page may contain token no longer valid. interaction previous page result in csrf false positive security event @ server.

so recommend use either per-session tokens or per-form tokens.