Synchronizer Token Pattern

web security

Definition

Synchronizer Token Pattern

A CSRF defence in which a random token is stored inside the (signed) session and also rendered into the form as a hidden POST parameter; the server compares the parameter against the session-held token on every state-changing request. A match proves the form was generated by the application that owns the session.

<form action="/transfer" method="post">
  <input type="hidden" name="csrf" value="token_b">
</form>

Set-Cookie: sess={u=bob, csrf=b_token}#sign

Robust against same-site tossing

Because the token lives inside the signed session, an attacker who tries to overwrite the session cookie replaces the whole session token with an unknown one and the comparison fails — and since the session also authenticates the victim, the victim is deauthenticated and the attack fails. If implemented correctly this is robust against both cross- and same-site CSRF; the caveat is that real-world implementations are frequently broken.