Anti CSRF tokens - explained

Why we should protect web forms and other sensitive links on websites using CSRF tokens. Describing protection tokens using: sessions and double cookies submission methods. Useful for ensuring secure client-to-server communication coming from a trusted source.

💖Support on Patreon:
----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------

[Michal_Silski]

HttpOnly cookie doesn't prevent from CSRF. In case you described, if attacker knows API call structure it is still possible to redirect the user to the external site from where malicious API call could be automatically submitted (it includes both cookies so server validates it successfully). To protect against CSRF you need to include csrf token both in cookie and in http call parameter to API.
HttpOnly can be used rather as protection against XSS.

[ravindrabhatt]

why will the attacker modify xcsrf cookie before sending?

[jjenisha-ec]

Thank you, if i use jwt token then csrf is needed ?

[vlegend.]

So the web browser can generate the original crsf token and be valid?