security token problem with ajax requests

Question

when building apps I use a token to prevent attacks on the forms

each time a form is rendered it gets a new ONE TIME security token that i include in the form as a hidden field. this token is also stored in the session.

when the form is sent, the token is verified against the token in the session to make sure the form is legit. This works great for standard pages.

PROBLEM when using Ajax to send forms, there may be multiple on a page, once you send one of these forms, the token is then invalid for the others as its a one time token.

does anyone have advise for this? or is it secure enough to generate one token per session and just use that instead of invalidating the token each time a form is sent?

Answer 1

If you want to follow your current approach, you can generate a security token each time you do a an AJAX request, return it in the AJAX response, and inject it into the hidden when you get it. However, I'd go rethinking your current approach for security tokens. Here you have some tips about that in the OSWAP wiki.