BOX-166 Resolve - implement timeout skew and range

Author: jclausen

ModuleConfig.cfc

@@ -36,6 +36,8 @@ component {
 			// By default, all csrf tokens have a life-span of 30 minutes. After 30 minutes, they expire and we aut-generate new ones.
 			// If you do not want expiring tokens, then set this value to 0
 			rotationTimeout        : 30,
+			// The interval in seconds within which, if a token's expiration is impending, we force generate new token for the user.
+			timeoutSkew : 60,
 			// Enable the /cbcsrf/generate endpoint to generate cbcsrf tokens for secured users.
 			enableEndpoint         : false,
 			// The WireBox mapping to use for the CacheStorage

models/cbcsrf.cfc

@@ -60,12 +60,7 @@ component accessors="true" singleton {
 			// Is it a new key?
 			!csrfData.keyExists( arguments.key ) ||
 			// Has the token expired?
-			(
-				csrfData[ arguments.key ].expires != "never" && dateCompare(
-					now(),
-					csrfData[ arguments.key ].expires
-				) == 1
-			)
+			tokenInExpiryRange( csrfData[ arguments.key ] )
 		) {
 			// Generate a new token
 			csrfData[ arguments.key ] = {
@@ -87,6 +82,22 @@ component accessors="true" singleton {
 		return csrfData[ arguments.key ].token;
 	}
 
+
+	/**
+	 * Determines if the token is within the expiry range
+	 * @tokenData The token data struct
+	 *
+	 * @return True if the token is within the expiry range
+	 */
+	private boolean function tokenInExpiryRange( required struct tokenData ) {
+		if ( tokenData.expires == "never" ) {
+			return false;
+		}
+
+		var secondsToExpiry = dateDiff( "s", now(), tokenData.expires );
+		return secondsToExpiry <= variables.settings.timeoutSkew;
+	}
+
 	/**
 	 * Validates the given token against the same stored in the session for a specific key.
 	 *

readme.md

@@ -74,6 +74,8 @@ moduleSettings = {
 		// By default, all csrf tokens have a life-span of 30 minutes. After 30 minutes, they expire and we aut-generate new ones.
 		// If you do not want expiring tokens, then set this value to 0
 		rotationTimeout : 30,
+		// The interval in seconds within which, if a token's expiration is impending, we force generate new token for the user.
+		timeoutSkew : 120,
 		// Enable the /cbcsrf/generate endpoint to generate cbcsrf tokens for secured users.
 		enableEndpoint : false,
 		// The WireBox mapping to use for the CacheStorage