I’ve watched the Pluralsight course on web security, which states that to mitigate CSRF attacks, the website should return two “paired” CSRF tokens to the client, one in a hidden form field and another in a cookie, that are associated to the user’s session. These tokens are issued whenever the user visits a page with, e.g., a form.
Now, since the attacker’s website can’t get the hidden form field token (same-origin policy), it cannot issue a valid request to the page containing the form.
But why are two CSRF tokens necessary in order to prevent CSRF? Isn’t the form field token sufficient by itself?