Lukas' Notes

web security

Definition

Double Submit Pattern

A CSRF defence in which a random token is sent to the browser both as a cookie csrf and as a hidden POST parameter, and the server compares the two on each state-changing request. A match means the party that submitted the form also holds the cookie, which a pure cross-site attacker cannot do — they can forge a POST with any body, but cannot set a cookie for bank.com.

<form action="/transfer" method="post">
  <input type="hidden" name="csrf" value="b_token">
</form>

Broken by same-site cookie tossing

The assumption “an attacker cannot set a cookie for bank.com” is only true for cross-site attacks. A same-site attacker can toss a csrf cookie onto bank.com with a value they know, then POST from their subdomain — the two csrf values match and the defence falls. Use the synchroniser token pattern when same-site attackers are in scope.