Contents
When a user logs into the site, a session is created and the session ID is set as a cookie in the browser. At the same time, another cookie is set for the CSRF token. Next, when the user submits a secure form, this token is extracted from the cookie and is set as a hidden input field in the HTML.
Why is the double submit Cookie not secure?
Therefore, in the OWASP documentation, the double submit cookie is classified as one of defense in depth. The reason is that cookies can be set by a third party with MITM attack. HTTPS requests and responses cannot be eavesdropped or modified.
How does a CSRF attack work in OWASP?
From OWASP page : A CSRF attack works because browser requests automatically include all cookies including session cookies. To prevent it, we can use double-submit cookie hash. In some sample codes I found, basically this algorithm is found.
How does the double submit Cookie pattern work?
With a significant amount of users consuming the system at a given time, the memory used will also grow exponentially. This is when Double Submit Cookie pattern comes to play. In Double Submit Cookie Pattern, the server will not store the tokens, hence called Stateless CSRF Defense. How does it work?
What is the SameSite attribute in CSRF protection?
SameSite is a cookie attribute (similar to HTTPOnly, Secure etc.) which aims to mitigate CSRF attacks. It is defined in RFC6265bis. This attribute helps the browser decide whether to send cookies along with cross-site requests.
How does cross-site request forgery ( CSRF ) attack work?
Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user’s web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include all cookies including session cookies.