title: Best practice pattern for service worker background-sync with CSRF protection
body: <p>I have a request that uses a one time token embedded in the page to ensure CSRF protection - an attacker might be able to fool my users into making a illicit request, but they can't get the token, and even if they can it is changed with each request and can expire.</p>
  
  <p>So far, so secure.</p>
  
  <p>I want to implement background-sync with a service worker, so a user can post data offline, and then send that data later when they get a connection.</p>
  
  <p>However, that means that the page isn't available to get the CSRF token, and any token linked with the request when the user builds it may be invalid by the time the data is actually sent.</p>
  
  <p>This would seem to be a general issue with any progressive web site, what is the best practice to handle it?</p>
  
  <p>I think that the background-sync could request a new token, apply it to the data to send and then send it, and that still be a loop that a CSRF attacker couldn't take advantage of, but I'm not certain of that. Can anyone confirm this either way?</p>
  
  <p>Is there some feature of service workers or background sync that I'm missing?</p>