We use a CSRF cookie on all of our forms that send data via HTTP POST. By default, the CSRF cookie out lives the session cookie by 2+ hours, in order to ensure it does not expire for users that still hold a valid session. We do notify users of sessions about to expire and give them the ability to extend it.
Yesterday, I got a report about a bug that prevented someone from logging in. When I investigated, I found that the user had arrived to our login form (which does not start a session until submitted) twelve hours before actually submitting the form. This threw a cryptic 'not authorized to see this page' error from the framework that we use.
I've taken care to make that error more informative for the benefit of someone NOT trying something malicious with provisions for the user to fix the problem.
What is the proper way to handle situations wherein the user has only a certain amount of time to do something before not being able to do it? What I'm considering is just refreshing the page a few minutes before the CSRF cookie expires to prevent it from expiring (or regenerate the token), and stopping that countdown if keyboard / focus events fire to prevent the corner case of reloading on a user while they type. JS is a requirement to be able to use the system, it's just not practical for us to deal with it being disabled.
This isn't a 'typical' timed event, as most users don't know and don't care about CSRF tokens or when they're going to expire. It's not like a quiz page where the user has 30 seconds to answer a question. This should be something the user never sees.
I'm quite certain that I'm not the first person to encounter this scenario, so I'm wondering if there is a standard way of handling it?