New CSRF token per request or NOT?

Question

So I am reading around and was really confused about having a CSRF token, whetever I should generate a new token per each request, or just per hour or something?

Answer 1

At owasp site it mentions that

Per-request tokens are more secure than per-session tokens as the time range for an attacker to exploit the stolen tokens is minimal. However, this may result in usability concerns.

And it concludes that

CSRF tokens should be:

• Unique per user session.
• Secret
• Unpredictable (large random value generated by a secure method).