title: Do ASP.NET MVC CSRF Anti-Forgery Tokens expire?
body: <p>I am implementing CSRF Anti-Forgery protection in my ASP.NET MVC 5 application. In particular, I am referencing the approach described by Mike Wasson on the <a href="http://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-(csrf)-attacks" rel="noreferrer">ASP.NET website</a> to protect controller methods that respond to AJAX requests, such as in WebAPI controllers. This approach makes use of the <a href="http://msdn.microsoft.com/en-us/library/system.web.helpers.antiforgery.gettokens(v=vs.111).aspx" rel="noreferrer">AntiForgery.GetTokens</a> method to generate user-based cryptographic anti-forgery tokens, and then <a href="http://msdn.microsoft.com/en-us/library/jj158363(v=vs.111).aspx" rel="noreferrer">AntiForgery.Validate</a> to verify that the submitted tokens belong to the current user.</p>
  
  <p>My question is this: is there a time-to-live for these tokens? Do they expire, and if so, how long are they good for? The documentation is mute on the subject.</p>
  
  <p>I do not want to permit non-expiring tokens in my system. Additionally, I want to communicate to the client how much time they have before requesting a new token is necessary. I can implement expiring tokens, if necessary, using <a href="http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.encrypt%28v=vs.110%29.aspx" rel="noreferrer">FormsAuthentication.Encrypt</a>; however, if expiration is already built into the <code>AntiForgery</code> class' methods, then I'd like to spare myself the unnecessary complexity. </p>