Handling and expired CSRF token

[dmeinke-etc]

How you all handle and expired CSRF token. For example a user gets logged out and then after lunch the login page is still open but the token has expired. the user goes to login and they can't because the token is expired. I have an error message that say Please go back, refresh your page and try again. I'm sure there are better ways. Just looking for ideas in general.

[WeyIin]

That's how it is usually handled; a token that is on a page has X minutes of validity and the only way to get around it is refresh the page.
Even some bigger banks have some systems in place that notifies users "page has expired, please reload" or something along these lines.