Well, instead of generating two separate tokens, a simpler solution IMHO is overloading the cookie, and it's what I usually see and use. What are you talking a

Well, instead of generating two separate tokens, a simpler solution IMHO is overloading the cookie, and it's what I usually see and use. What are you talking about "if an attacker can influence the ACTION attribute of the form"? If they are running JavaScript in your DOM you are already hosed, they can grab any token you put in your form. There is no sane reason for having ACTION change via request parameters: you would have bigger issues than session stealing. And in any other situation, you should be protected by the browser's cross domain restrictions. I don't understand what you are suggesting.