Can somebody tell me more details about it?
5 Answers
for more information I think this short manuscript can help up :
The client requests an HTML page that contains a form. server includes two tokens in the response. One token is sent as a cookie. The other is placed in a hidden form field. The tokens are generated randomly so that an adversary cannot guess the values. the client submits the form, it must send both tokens back to the server. The client sends the cookie token as a cookie, and it sends the form token inside the form data. (A browser client automatically does this when the user submits the form.) a request does not include both tokens, the server disallows the request.
Related