OWASP Top 10 Defense · Double-Submit Cookie · CSPRNG

CSRF Token Generator

Generate cryptographically strong Anti-CSRF tokens to safeguard web forms and API endpoints. Test the Double Submit Cookie verification pattern and copy framework code.

Entropy Size:

Cryptographic Random Anti-CSRF Token:256 bits CSPRNG

HMAC-Signed CSRF Token (Stateless Protection):

HMAC Key: . Token format is <random_payload>.<hmac_digest>.

Interactive Verification Simulator (Double Submit Cookie Pattern)RFC 6749 Flow

Browser Cookie Storage (__Host-csrf)

Incoming Header / Body Token (X-CSRF-Token):

Implementation Code Snippet:

// app/actions.ts (Next.js Server Actions with CSRF Cookie)
import { cookies, headers } from 'next/headers';

export async function submitProtectedForm(formData: FormData) {
  const cookieStore = await cookies();
  const csrfCookie = cookieStore.get('csrf_token')?.value;
  const formCsrf = formData.get('csrf_token');

  if (!csrfCookie || !formCsrf || csrfCookie !== formCsrf) {
    throw new Error('403 Forbidden: Invalid CSRF Token');
  }

  // Safe to execute state-changing database operations
  return { success: true };
}

Demystifying Cross-Site Request Forgery (CSRF) & Modern Defenses

How Does a CSRF Attack Work?

Cross-Site Request Forgery (CSRF) tricks an authenticated victim into executing unwanted actions on a trusted web application.

Because web browsers automatically attach session cookies to cross-origin requests (such as form submissions or image fetches from external sites), a malicious page can trigger an unauthorized POST request to /transfer-funds without the user's explicit consent.

Double Submit Cookie Pattern & SameSite Cookies

Two primary defenses prevent CSRF attacks in modern web development:

Double Submit Cookie Pattern: The server sends a random token in a cookie and requires JavaScript to read that token and send it back in a custom header (e.g. X-CSRF-Token). Because the Same-Origin Policy (SOP) prevents malicious external origins from reading your cookies, attackers cannot forge the required header.
SameSite=Lax/Strict: Instructs browsers never to send cookies on cross-site form POSTs, providing built-in browser-level mitigation.