I would like to know how the CSRF tokens are verified on form submit?

Please tell me whether the following is correct:

  • Server issues a random string which is set as the session cookie, and a value for the hidden field in the form.

  • On the form submit, the server checks the session cookie with the hidden field value for equality, if values are not equal it won't process the request.

  • 2
    nope, because than the attack can easily forge them. its more of a rand() that gets assigned to a hidden value . that is matched against the rand() stored with the session.(so on the server) – LvB Jun 23 '16 at 14:35
  • 2
    @LvB this comment smells like an answer. – techraf Jun 23 '16 at 15:10
  • @LvB As long as the string is random, I think this is secure. An attacker can't read the data to learn the token value and they can't alter the cookie value to make it match what they set in the fiekd – Neil Smithline Jun 23 '16 at 18:11
  • Everything you need to know: owasp.org/index.php/… The double submit cookie pattern (that you describe) is also there... – eckes Jun 23 '16 at 19:32

Yes, this is one possible approach to defending against CSRF. It's called the double submit cookie pattern.

The synchronizer token pattern - the second token isn't stored in a cookie but server-side in the session - is a bit more common in practice though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.