Beginner LevelAuthentication & Authorization
How does the Double Submit Cookie pattern defend against CSRF attacks?
❓ Interview Prompt: Explain CSRF vulnerabilities, stateless CSRF protection, and Double Submit Cookie validation logic.
When SameSite cookies cannot be used (e.g. legacy browsers or cross-domain POST requests), applications use CSRF Tokens. The Double Submit Cookie Pattern provides stateless CSRF protection without server session state.
How Double Submit Cookie Works:
1
When generating a response, the server sets a random, high-entropy CSRF token in a non-httpOnly cookie ('csrf_token=random_string').
2
When submitting a POST request, client JavaScript reads 'csrf_token' from the cookie and attaches it in a custom HTTP header ('X-CSRF-Token: random_string').
3
The server compares the cookie value against the custom header value.
4
Security Principle: Malicious cross-site scripts on external domains can cause browsers to send cookies automatically, but SOP (Same-Origin Policy) prevents them from reading the cookie value to populate the custom header!
Code Implementation Example
typescript
// Express CSRF Double Submit Cookie validation middleware
function validateDoubleSubmitCsrf(req: Request, res: Response, next: NextFunction) {
const cookieToken = req.cookies['csrf_token'];
const headerToken = req.headers['x-csrf-token'];
if (!cookieToken || !headerToken || cookieToken !== headerToken) {
return res.status(403).json({ error: 'CSRF Validation Failed: Token Mismatch' });
}
next();
}💡Validating CSRF token match between cookie and custom HTTP header.
🎯 Interview Key Takeaway
Double Submit Cookie pattern verifies that a custom HTTP header matches a cookie value, blocking cross-site CSRF submissions.
#CSRF#CSRF Tokens#Double Submit#Security#Beginner
Back to all Authentication & Authorization Questions→