CSRF Token with Cookies

CSRF Token with Cookies

Cross-site Request Forgery protection in web applications via Double Submit Cookies Patterns

In the previous blog post, I have discussed how to achieve CSRF attack protection using synchronized token pattern method. In this post, I am going to discuss how to enable CSRF protection using double-submitted cookie pattern.

What is the double-submitted cookie?

When a user authenticates to a site, the site should generate a (cryptographic-ally strong) pseudo random value and set it as a cookie on the user’s machine separate from the session ID. The server does not have to save this value in any way, that's why this pattern is also called Stateless CSRF Defense.

In double-submitted cookie pattern, two cookies (for the session and for the CSRF token) are stored in the browser.
In our previous method, we stored CSRF token values on the server side (text file). But here we don't do it.