I would like to know how the CSRF tokens are verified on form submit?

Please tell me whether the following is correct:

  • Server issues a random string which is set as the session cookie, and a value for the hidden field in the form.

  • On the form submit, the server checks the session cookie with the hidden field value for equality, if values are not equal it won't process the request.

  • 2
    nope, because than the attack can easily forge them. its more of a rand() that gets assigned to a hidden value . that is matched against the rand() stored with the session.(so on the server)
    – LvB
    Jun 23, 2016 at 14:35
  • 2
    @LvB this comment smells like an answer.
    – techraf
    Jun 23, 2016 at 15:10
  • @LvB As long as the string is random, I think this is secure. An attacker can't read the data to learn the token value and they can't alter the cookie value to make it match what they set in the fiekd Jun 23, 2016 at 18:11
  • Everything you need to know: owasp.org/index.php/… The double submit cookie pattern (that you describe) is also there...
    – eckes
    Jun 23, 2016 at 19:32

1 Answer 1


Yes, this is one possible approach to defending against CSRF. It's called the double submit cookie pattern.

The synchronizer token pattern - the second token isn't stored in a cookie but server-side in the session - is a bit more common in practice though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .