CSRF token as a risk signal

[thesourcerer8]

I would like to use CSRF tokens in the application as indicators of attack. Both whether the token is present, whether it is valid, the time between the token issueing and the token consumption and any token reuse. The challenge is that sometimes there is a legitimate use for external applications doing cross-site requests, so it depends on the referrer page, whether it is ok to get requests with missing tokens or not. I guess that most other people are just denying requests without a valid CSRF token directly, but from my point of view, the intelligence we could gather from such requests could be very valuable.
What's your viewpoint on this?

[thesourcerer8]

A related idea is to measure the availability of Javascript in the client and to use that as an indicator too.

[thesourcerer8]

I would call the CSRF token time the "form-fill-time", and have rules like less than 10 seconds being unrealistic for a complex form and a normal user.

[onerrit]

@thesourcerer8

Implementation here is more related to your product, how customers use it, and specific threats. On the tirreno side, perhaps you can use field history to store CSRF tokens and build risk rules around them.