Double submit cookies are vulnerable to cookie injection from the same domain. What if I use a custom header instead of a cookie?
Example HTTP request:
header X-CSRF-PROTECTION = 5a445s66gg54s45a54 POST X-CSRF-PROTECTION = 5a445s66gg54s45a54, param1=aaa....
Isn't that safer?
Edit: ok, I was confused, thanks to Anders now I have a more clear idea.
I'd like to avoid to put an hidden form fields, but I want provide a decent protection.
I always use json ajax based interaction
I always check that content-type is 'application/json"
So, what I proposed before doesn't add security.
store at login time a random token in SESSION and as COOKIE
every ajax request, should read the cookie and set it as request header
the server can compare the header with session value
What do you think about?