Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In double cookie submission, you are not issuing two requests to the server, but rather using javascript to append the session id to either the post body or the URI.

Since the browser automatically submits the cookie via HTTP Headers, single submission by itself is not safe. Since a third party cannot read the value of the cookie, they cannot recreate the proper request and will, consequently, fail.

Of course, both our methods will fail under an XSS, but should still prevent CSRF. I still think a cryptographically generated secret stored in the cookie is less guessable than a timestamp.



The timestamp, session_id and user_id are tucked away in an AES encrypted bundle with a SHA-1 signature.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: