L3 - Default When concurrent requests (related to the same http session) try to generate a CSRF token, then for each request a CSRF token is generated, whereby the last one wins and is stored in the http session.
The creation of CSRF tokens should be synchronized [1], like
if (session.getAttribute(CsrfConstants.CSRF_TOKEN_SESSION_ATTR_NAME) == null) { synchronized(<session_mutex>) { if (session.getAttribute(CsrfConstants.CSRF_TOKEN_SESSION_ATTR_NAME) == null) { // TODO... } } }
To synchronize a "session mutex" could be used.