A CSRF token is not an access token and does not have a lifetime like bearer tokens do. They are generated using session information.
csrf_token = HMAC(session_token, application_secret)
CSRF adds additional information to your requests that lets the server verify the requests comes from an authorized location.
It only affects requests where the authorization info is sent automatically by the browser (cookie auth or basic/digest scheme)
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
