How is CSRF token verified?

Question

I would like to know how the CSRF tokens are verified on form submit?

Please tell me whether the following is correct:

Server issues a random string which is set as the session cookie, and a value for the hidden field in the form.
On the form submit, the server checks the session cookie with the hidden field value for equality, if values are not equal it won't process the request.

nope, because than the attack can easily forge them. its more of a rand() that gets assigned to a hidden value . that is matched against the rand() stored with the session.(so on the server) — LvB, Jun 23, 2016 at 14:35
@LvB As long as the string is random, I think this is secure. An attacker can't read the data to learn the token value and they can't alter the cookie value to make it match what they set in the fiekd — Neil Smithline, Jun 23, 2016 at 18:11
Everything you need to know: owasp.org/index.php/… The double submit cookie pattern (that you describe) is also there... — eckes, Jun 23, 2016 at 19:32

tim · Accepted Answer · 2016-06-23 16:46:20Z

2

Yes, this is one possible approach to defending against CSRF. It's called the double submit cookie pattern.

The synchronizer token pattern - the second token isn't stored in a cookie but server-side in the session - is a bit more common in practice though.

answered Jun 23, 2016 at 16:46

tim

29.5k7 gold badges97 silver badges121 bronze badges

Add a comment |

1 Answer 1