The CSRF synchronized token makes sense up to certain point. Can someone explain the rest in a childish manner to where I can understand it.
When a user logs in they are given a session ID and a CSRF. The session ID is stored in session cookies and the CSRF token only stored on the page, preferably in a hidden field. When a user submits a request that requires special privileges the CSRF token is sent with it. The server verifies that is the user and commits the action.
Okay here's where I'm having the problem. If a user gets his session id stolen along with any other identification, say from a man-in-the-middle attack, which doesn't need XSS. Wouldn't the malicious user be given the same CSRF token that was given to the session to that user?
- Ignoring headers answers for prevention please *