thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Double-Submit Cookie

A stateless CSRF defense in which a random value is sent both in a cookie and in a request parameter or header, and the server checks they match.

Definition

Attackers cannot read or set the victim's cookie for the target domain, so they cannot supply a matching parameter. The signed double-submit variant binds the value to the session with an HMAC to resist cookie injection from subdomains.

Example

An SPA sends the XSRF-TOKEN cookie value in an X-XSRF-TOKEN header on every API call.

Exam tip

Use the signed variant; naive double submit is weaker than synchronizer tokens.

Related terms