Understanding CSRF Prevention with Double Submit Cookies

A CSRF token is a unique, unpredictable value associated with a user's session, ensuring each request comes from a legitimate source. One effective implementation is the Double Submit Cookies technique, where a cookie value corresponds to a value in a hidden form field.

Key Points

• CSRF Token: A unique, unpredictable value associated with a user's session.
• Double Submit Cookies: A technique where a cookie value matches a value in a hidden form field.
• Verification: The server checks that the cookie value matches the form field value for an additional layer of verification.

How Double Submit Cookies Work

When the server receives a request, it checks that the cookie value matches the form field value, providing an additional layer of verification.

Possible Bypass Scenarios

• Session Cookie Hijacking: Man in the Middle Attack
• Subverting the Same-Origin Policy: Attacker Controlled Subdomain
• Exploiting XSS Vulnerabilities
• Predicting or Interfering with Token Generation
• Subdomain Cookie Injection

Learn More

For more detailed information, refer to the OWASP Cross-Site Request Forgery Prevention Cheat Sheet.