CSRF and double posting

This is BAD advice, don't listen to it.

The fact that you think token regeneration is related to the described problem, shows that you don't understand how CSRF protection works. Thus, you shouldn't randomly tell people to turn security features Off.

I only read the title and the first post, which describe the issue as submitting a form twice, which this setting will break if the first request reaches the server. It also creates problems with single page apps unless you pass the token back and forth as it changes between requests. You can forget about concurrent AJAX requests with this enabled. So yes, I do understand how it works, what it's trying to protect against, and why regeneratting it isn't necessary.

Put this at the top of your .htaccess to prevent your site from being loaded into an iframe and have your login page generate the CSRF token.

Code:

Header always append X-Frame-Options SAMEORIGIN

Here's a few pages of reasons why this option does not improve security: http://security.stackexchange.com/questi...rm-request

We've paid to have our app penetration tested and they found no fault with this design.