Cphalcon: [NFR]: Don't change the CSRF token on every request

[harm-smits]

Is your feature request related to a problem? Please describe.
Sessions do not change in some cases, but the CSRF token does change somehow. There should be an option to avoid this token from changing on every single request to prevent writes to the session store.

Describe the solution you'd like
There should be a manual option to 'disable automatic regeneration' of the CSRF token. After this, to get a new CSRF token, someone ought to trigger a function to refresh it.

Describe alternatives you've considered
None

Additional context
DynamoDB is a NoSQL store that plays a major role in the dominant position of AWS. As it can asynchronously replicate itself across multiple data centers and can store an infinite amount of data, it is the go to choice for many companies to use as session store or cache.

DynamoDB gets priced by means of reads / writes provisioning. If unnecessary writes can be avoided, it can drastically reduce the price of such services. In order for Phalcon to be viable for services that have thousands of simultaneous users, this behavior ought to be changed.

Because of this, there should be an option to refresh the CSRF token manually, to avoid writes to DynamoDB when no data in the session has changed.

[ekmst]

Yes, I agree. It would be convenient if the CSRF token worked without a session

[ruudboon]

@ekmst Without session it wil be hard. You need to write at least once.

[ekmst]

@ruudboon Can we try to implement this using a secret key and HMAC?

[ruudboon]

@ekmst we could investigate something like that. Sounds like a new feature request and not directly related to this issue.

[harm-smits]

What also could be a possibility, is that you always generate a CSRF token when a session could not be found, but have the ability to manually trigger the refresh:

$this->security->csrfRefresh();

And just allow people to set this behavior as follows:

new Security([
   'autoCsrfRefresh' => false
]);

[ruudboon]

@v00v Please create a separate issue for this and let's keep this one only about the refreshing.

[v00v]

@ruudboon No problem. I removed it, Ignore it please.

[ruudboon]

Closing this: Please vote for this feature here: #14608