Contents
The CSRF token in fact could be the standard authentication cookie when using this method, and this value is submitted via cookies as usual with the request, but the value is also repeated in either a hidden field or header, of which an attacker cannot replicate as they cannot read the value in the first place.
What can you do with a CSRF token?
A CSRF Token is a secret, unique and unpredictable value a server-side application generates in order to protect CSRF vulnerable resources. The tokens are generated and submitted by the server-side application in a subsequent HTTP request made by the client.
Is it safe to use the session ID as a CSRF token?
The argument against reusing the session ID as the CSRF token can be summarized as follows (key points in bold, with justification beneath): The session ID being acquired by an attacker is generally a more serious security breach than the CSRF token being acquired by an attacker.
Why are CSRF cookies stored in the session?
Storing them in the session makes them impossible to retrieve. Storing token in a cookie is not a solution to the CSRF problem. The CSRF vulnerability arises from the fact, that browser automatically sends cookies along with the request. As a result application considers that request as coming from valid (and authenticated) user.
Session cookies, on the other hand, can be kept secret even in the face of a successful XSS attack using the HttpOnly flag, demanding more up-front work from an attacker to usefully exploit an XSS vulnerability.
Can a malicious JavaScript code read the XSRF token?
If there’s an XSS exploit, then the malicious JavaScript code can read both the XSRF token and the SID cookie (?). An attacker cannot construct a valid XSRF token, given a SID, since s/he doesn’t have the secret key used when signing the SID to obtain the XSRF token.