title: How long is Spring temporary CSRF token expiration time?
body: <p>I enabled CSRF with spring security and it is working as expected.</p>
  
  <p>I read Spring official documentation about CSRF
  <a href="http://docs.spring.io/spring-security/site/docs/3.2.7.RELEASE/reference/htmlsingle/#csrf" rel="noreferrer">http://docs.spring.io/spring-security/site/docs/3.2.7.RELEASE/reference/htmlsingle/#csrf</a></p>
  
  <p>I also read this tutorial about CSRF with Spring and AngularJS
  <a href="http://www.codesandnotes.be/2015/07/24/angularjs-web-apps-for-spring-based-rest-services-security-the-server-side-part-2-csrf/" rel="noreferrer">http://www.codesandnotes.be/2015/07/24/angularjs-web-apps-for-spring-based-rest-services-security-the-server-side-part-2-csrf/</a></p>
  
  <blockquote>
    <p>What Spring Security does is that it sets up a temporary session for
    that. So basically it goes like this:  </p>
    
    <ol>
    <li>The client asks a token with an OPTIONS request.   </li>
    <li>The server creates a temporary session, stores the token and sends back a JSESSIONID and the token to the client.   </li>
    <li>The client submits the login credentials using that JSESSIONID and CSRF token.     </li>
    <li>The server matches the CSRF stored for the received JSESSIONID and, if all is green-lighted, creates a new definitive JSESSIONID and a new session-based CSRF token for the client to validate its requests after the login.</li>
    </ol>
  </blockquote>
  
  <p>As I have understood, when you are not logged in, you can get your first CSRF token by sending an OPTIONS request on any API endpoint, for example /api/login</p>
  
  <p>Spring will then create a CSRF token bound to a temporary session (temporary CSRF and JSESSIONID cookies)</p>
  
  <p>Thus, if I ask the CSRF token than wait a few minutes and finally try to login, the CSRF token may have expîred and I will have to ask another one.</p>
  
  <p><strong>I couldn't find how to configure the temporary Spring session expiration time and I couldn't find what was its exact default duration.</strong></p>
  
  <p>Does anyone has any information about that ?</p>