Cross-site-Request-Forgery-protection-in-web-applications-via-Double-Submit-Cookies-Patterns

Implementation of the Double Submit Cookie Pattern is bit similar to the implementation of the Synchronizer Token Pattern. So before reading this post, It is better to read the last post about the "implementation of Synchronizer Token Pattern". The link for the previous post is as fallows

https://hyperstella.blogspot.com/2018/05/cross-site-request-forgery-protection.html

Double submit cookie pattern does not store the token value in the server side.It store the token value inside the cookie in the client side.

In this post we are going to show the implementation process of Double Submit Cookie Pattern,

You can see a sample project (Github) :-

https://github.com/MalikDilsh/Cross-site-Request-Forgery-protection-in-web-applications-via-Double-Submit-Cookies-Patterns

Step 1:

First of all you have to Create a web application similar to the Synchronizer Token Pattern. Because the implementation process of the double submit cookie pattern is mostly equal, there're only small difference between those two (mentioned above).

Step 2:

We have to validate user credentials and create the session first. So wen generate random string and create CSRF cookies to store the random string.

Step 3:

Client side have to be like this,

Step 4:

Then we have to Validate CSRF token before perform the action requested through POST request. Server will read the CSRF cookie and derived the CSRF token from the cookie, then server check whether value taken from the cookie is the same as the value retrieved from the POST request.