Houdini
Hello,
according to [plug/lib/plug/csrf_protection.ex at main · elixir-plug/plug · GitHub](http://csrf source code) csrf tokens are saved in process memory.
However I can open any form with generated csrf token, then restart server. After restart I can successfully submit that form and csrf token will be correct. How is that possible?
Process memory should be empty again.
Few more questions:
- How csrf tokens are invalidated?
- It sounds like we should setup some kind of ttl for csrf tokens.
- Is it possible to generate infinite number of tokens and fill up computer memory?
Thanks for answering my newbi questions 
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Master modern tools, write cleaner code, and tackle real-world challenges with Manning books, videos, and courses. Start building today.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
voltone
That refers to the temporary state during request processing that allows the CSRF token to be injected automatically in any form rendered in the response. It does not refer to the reference value against which the CSRF token value in the form is verified in subsequent requests. That reference value is stored in the session, e.g. in the session cookie or in whichever session store is configured.
They have the same lifespan as the session. So if a user keeps a form open and their session does not expire in some way, the form submission should succeed without a CSRF error. Unless the server explicitly resets the CSRF token value in the session (which is only effective if the session store is not the session cookie store, since it cannot modify the session that was already sent to the user’s browser).
This is why DB-backed session stores are often preferable to session cookies: they allow for server-side invalidation of the session (and, as part of that, the CSRF token) due to inactivity timeout or some master session timeout.
If you are referring to the CSRF token in the process dictionary, then no, because it is short-lived and is garbage collected when request processing completes and the process terminates.