title: How to generate a new CSRF token on every request without sacrificing usability or security?
body: <p><a href="https://www.whitehatsec.com/blog/raising-the-csrf-bar/" rel="nofollow noreferrer">This article</a> suggests that we should be changing our CSRF tokens on every request to prevent a BREACH attack. i.e., if we use gzip/brotli and per-session CSRF tokens, and SSL, our tokens are vulnerable with only 1000 requests.</p>
  
  <p>Supposing that's true, how would one go about regenerating a CSRF token on every request without breaking back/forward and multiple tabs?</p>
  
  <p>The obvious solution is to store an array of valid CSRF tokens in our session instead of just the most recent one, perhaps limiting it to 100 or so.</p>
  
  <p>But what if we used a JWT or something instead? We could store just the user ID in there, then validate that the token isn't expired and it belongs to the current user, and we wouldn't need to store it on the server at all. The only problem is that we couldn't revoke the CSRF-JWT when the user logs out, which would necessitate a short expiry, but we wouldn't want it too short or it'd expire before the user has a chance to submit the form.</p>
  
  <p>What's the best way to approach this problem?</p>