Project Euler Forum

I'm aware that this is because the server invalidates the CSRF token (viewtopic.php?p=56237#p56237), but there's a better alternative: Download the CSRF token on the client side using JavaScript if a significant time has passed since the page is loaded.

Of course this will not work with HTML-only clients (for those, there are other alternatives, such as sending the answer back with the page on POST request failed so the user doesn't have to refill it -- of course the user still have to click the submit button)

Currently, it's possible to do this automatically only with some changes on the client-side.

Another random suggestion while browsing the HTML source code: instead of having JavaScript focus the `guess` element, it's possible to simply use the `autofocus` attribute on the input field.

Thanks for the suggestion about autofocus. I wasn't aware of this new HTML5 attribute. Over time I'll consider convert existing pages to make use of it. But I must be aware of backwards compatibility. I think that some members are still using Netscape Navigator!

Regarding the CSRF token scheme. Currently it is handled server side which provide perfect security, but at the cost of server overhead and from a practical point of view it limits the number of browser tabs that members can have open. Consequently, it is already on my to-do list to review options to implement a stateless system that continues to provide the same level of security whilst maintaining unnecessarily complicated mechanisms. I know that many security experts, including OWASP, generally advise against transmitting tokens via cookies due to how easy a badly implemented system could leak data to server logs or even browser history. Plus wherever possible I would want to minimise the use of cookies as per the privacy policy on the main website.

However, the real issue, as you pointed out, is the member experience of working on a problem for a long period of time and after submitting an answer seeing that annoying message. In one sense I cannot change that. Regardless of the back-end system I choose to implement, as advised by security experts, I would always be deliberately implementing a relatively short expiration. So something else I have been contemplating is ways of addressing that. I've been considering options that would either require members to interact dynamically on the problem page when they are ready to submit an answer and/or after a period of time, if no answer is submitted, it would become clear that some action will need to be taken. Whereas the answer submission section requires the greatest attention, due to how frequently it is used by members, the same measures probably wouldn't address the other places where tokens are used, like on the Account page.