Is it possible for an attacker to spoof the double submit token/cookie, when the first token/cookie is in the Cookie header and the 2nd token/cookie is in the body params.

Yeah, there is a way using XSS but other than that?

2 Answers 2


No, unless there is some implementation error, you will not get anywhere. Why? Because you can not read the cookie value, so you wouldn't know what to set the value in the body to.

  • So that's why XSS is the only way to exploit this behavior. Nov 3, 2017 at 7:54
  • @januuagrawal Yes, exactly, with XSS you can read the cookie value. Without it you can't.
    – Anders
    Nov 3, 2017 at 9:28
  • Bugs in the CSRF token generation or the token check may also render it open to attack, such as accepting the cookie value as a query string parameter (eg in PHP, using $_REQUEST instead of specifically $_COOKIE), or letting the attacker pre-set the token themself (such as by setting the token based on an a pre-existing query string parameter if it exists instead of generating it anew whenever it's sent as a cookie). Dec 14, 2017 at 1:04

Don't know if it was relevant 2 years ago, but you can (possibly) bypass the protection using CRLF Injection if the Web Application is vulnerable to it. Briefly, CRLF is Carriage Return Line Feed(\r\n).

If any User controlled input value is reflected back in the response, %0d%0a(\r\n) is inserted in the input field followed by anything(Setting cookies in most cases). This will set the cookie in victim's browser with the param:value specified by the attacker. (You can refer to the link for a detailed insight on CRLF)

Thus, the concept is to manually set the header, "Set-Cookie:csrfKey={value}" with a known csrf token value to match the value in the request payload. So as a result, the server will accept the request and perform the action.

Double-submit-bypass Image reference: David Johansson's Presentation Slides

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .