3 ms·
How does server know the cookie is valid if it doesn't store it and how does it know csrf token is valid if it doesn't store it and finally how does it know tha
by mewpmewp2 2y ago
How does server know the cookie is valid if it doesn't store it and how does it know csrf token is valid if it doesn't store it and finally how does it know that this csrf token relates to this cookie session token if it doesn't store it?
- hansonkd 2y agoThe CSRF token can have nothing to do with the cookie session information. you can store CSRF as a separate cookie. You can validate the CSRF is valid by keeping a key on your server and matching that the token you get can be derived from that key. See Django's implementation of CSRF for more details. CSRF tokens are separate from session and no CSRF information needs to be stored in database to validate CSRF.