Zend Framework 2 CSRF validation - php

Question

I have application base on Zend framework 2. I have a form with CSRF field. If I fill the form and submit after around 5 minutes it gives me The form submitted did not originate from the expected site validation error.
So I assumed it might be some issue with session configurations. Then I added options to SessionConfig on module.config.php as follows
'session' => array(
'remember_me_seconds' => 2419200,
'use_cookies' => true,
'cookie_httponly' => true,
'cookie_lifetime' => '2419200',
'gc_maxlifetime' => '2419200'
),
But the problem still exist. Do you know how to fix this issue ?
--Update--
My form class contains the CSRF element as follows,
$this->add(array(
'type' => 'Zend\Form\Element\Csrf',
'name' => 'security',
'options' => array(
'csrf_options' => array(
'timeout' => 20000
)
)
));
None of these seems to work.

Answer 1

The Csrf system under ZendFramework configures the session duration from the parameter stored in the configuration of the Csrf element under the timeout key as shown in the following example :
$form->add([
'type' => Element\Csrf::class,
'name' => 'csrf',
'options' => [
'csrf_options' => [
'timeout' => 600,
],
],
]);
Put the session config under the config key as shown in the following example :
'session' => [
'config' => [
'class' => Zend\Session\Config\SessionConfig::class,
'options' => [
'name' => 'SID',
'use_cookies' => true,
'cookie_httponly' => true,
'remember_me_seconds' => 2419200,
],
],
]