Combining Session and CSRF cookie about nosurf HOT 3 CLOSED

This is a defense mechanism called "Double Submit Cookie" and OWASP recommends having them as separate cookies: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

Also, there is no good protection against CSRF if you are XSS vulnerable as the request is coming from the same domain (and thus not cross-site).

from nosurf.

Thanks, I wrote part of the "Double Submit Cookie" section actually. Sending two cookies helps the implementation be less prone to error, but isn't technically more secure than sending one cookie (assuming they are from the same domain/path as you mention).

My question was one of reducing bandwidth and resource usage.

from nosurf.

Ok then I misunderstood what you're proposing. By the way, you can set the default cookie values using this but I agree that it should be httpOnly per default.

from nosurf.