title: Csrf token pool in cookie for singlepage app?
body: <p>My application is singlepage application. Client-server communication is running via ajax API except first page load (index.html/php) and templates are frontend based. Server only valid response is json. </p>
  
  <p>Every form submit is being handled with javascript. </p>
  
  <p>Server token validation is not part of this question. </p>
  
  <p><strong>My first flow</strong></p>
  
  <ul>
  <li>User enter the page where is csrf token as some html value. </li>
  <li>Javascript pick token and save it as javascript variable.  </li>
  <li>As user go thrue app, with each backend request (POST) javascript append csrf token. New csrf token is present in response. </li>
  </ul>
  
  <p>But this flow had a problem, once user opens another window, csrf token wont be valid for previous window.</p>
  
  <p><strong>My second flow</strong></p>
  
  <ul>
  <li>User enter the page and csrf token is present as a cookie</li>
  <li>As user go thrue app, with each backend request (POST) javascript pick csrf token from cookie and append it to the request. </li>
  <li>After request is done, server changes the cookie value. </li>
  </ul>
  
  <p>(Notice that in this flow server doesnt validate the cookie itself but the value we ghater from cookie.)</p>
  
  <p>This flow is slightly better, user can have multiple windows opened, but still only one request is valid at the time. </p>
  
  <p><strong>My third flow</strong></p>
  
  <p>It is same like second flow, but insted of one csrf token, server provides pool of tokens. User is limited to ask as many requests as is the size of the pool (implementator choice). Requests use only one token at the time and this token is being marked as "in use". Each time request hits the server, server renew csrf token in the pool with new value. </p>
  
  <p>Questions:
  <strong>Would you consider second and third flow as safe practise or is there a way to cheat this somehow? 
  Is third flow "application persistent"?</strong> </p>