I did at some point believe that the CSRF token my plugin requests was using expired in the middle of a request, but it turns out that they were never included in the first place.

Still curious, I wonder how long a CSRF token lasts?

1 Answer 1


Each session gets it's own CSRF token, so technically it will be valid as long as a session is valid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.