I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token into a session variable of the logged in user and display it on a page in a hidden field. If you submit a form now the server compares the session variable and the form field. If they match you are good to go.
What are the drawbacks of this idea? Why should you place the token into a own cookie which could be stolen? Aren't you minimizing your attacking surface if you store it server side?