Recently I came across some websites using HTTP Header namely X-XSRF-Token and a cookie with similar name. Is it a better mitigation than using random token based security for CSRF?

  • 1
    If you use script triggered request, why use a cookie at all? I'd simply use the http authentication header. Jan 15, 2015 at 14:33

1 Answer 1


Yes you could use something like the X-Requested-With header - this header cannot be passed cross domain without the server opting into this with the domain in question via CORS.

The synchronizer token pattern is still the recommended method by OWASP - one of the reasons is that there have been vulnerabilities in the past with browser plugins (e.g. Flash) that have allowed headers to be set that normally can't be set in the browser via JavaScript.

So for that reason I would recommend the synchronizer token pattern over checking headers, but at the moment of writing both are equally good. You never know if there's a Flash zero-day around the corner though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.