I would like to know how the CSRF tokens are verified on form submit?
Please tell me whether the following is correct:
Server issues a random string which is set as the session cookie, and a value for the hidden field in the form.
On the form submit, the server checks the session cookie with the hidden field value for equality, if values are not equal it won't process the request.