I have read up on the Double Submit Cookies vulnerabilities question and while it answers a bunch of questions I am still a bit confused.
I have taken a look at this repo: https://github.com/jeongl/express-jwt-csrf-auth
The summary of this implementation is that on the authenticated request they send a CSRF token in cookie1 and a JWT token (which includes the CSRF token) in cookie2.
The client then takes the csrf token out of cookie1 and stores it locally (assumed) and makes a request with an x-csrf-token header with the csrf token.
The server then decodes the JWT token and extracts the csrf token from the original response and compares it against the x-csrf-token header.
My question is that if an attacker gets access to the cookies can they not extract the csrf token from the cookie1 and send the request with a x-csrf-token header in a form request along with cookie2.