Cross-site Request Forgery Protection in Web Applications via Double Submit Cookies

When a user logs in to a web application the site generates a random value and sets it as a cookie. A double submit cookie sends this value as a cookie but also as a request parameter. The server then confirms that the cookie value and the request parameter value match before executing a transaction request. An attacker can not change a cookie value with a CSRF attack, so even if the request parameter is manipulated the malicious request will not execute.

You can get a sample login page from here: https://github.com/csandeepa/CSRF-double-submit-cookies

Once you run the code you can see a login page like this.

The initial page is index.php. here is how it looks like.

The login form is created using basic html codes. the form submission method is POST. and also here you can see session generation and validation of login credentials codes written in php.

After successfully logged in, the user is redirected to the update.php page.There is a function to get cookie value.

Here is the way of implementing double submit cookies for a login. CSRF prevention is really important for security of a website.

~CS