14
votes
3answers
491 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
5
votes
3answers
896 views

CSRF Countermeasures

I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...