Bharath Thivagaren

In Synchronize Token method the client and the server both should generate the same token value. The server has to do what client does. So it will be a heavy load to the server,Therefore we are using double submitted cookies method. If we need to use double submitted cookies, the javascript should run in in the cookie. So HTTP Flag should be off. In here we are sending the same cookie (that means our session cookie) through HTTP body and the HTTP header. So the server will validate if the cookie coming from the body and the header are same or not and accept the request or deny. In the client side (index.php) we create the session and store it in the cookie.After that create a token and store it in a new cookie.                                                                      Figure 1 ...

What is cross-site request forgery (CSRF)? Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently  authenticated. CSRF attacks specifically target state-changing requests,  not theft of data, since the attacker has no way to see the response to the forged request. We can avoid these kind of attack (CSRF) by two ways 1. Synchronizer Tokens 2. Double submitted cookies In this case, we are considering about Synchronize Tokens.  When we login, there will be a random number generated and stored on both the client side and server side. So when the attacker creates the code, he wont be knowing the token value. So he can not create a code with the correct token value. Anyhow, if the victim clicks the link, that will not be harmful. because the  token verification will fail. For the first step we want to create the session in the client side (index.php). Then we w...