Double-Submit Cookie ·
One Token, Two Channels
un
seel
.com · Stateless CSRF defense · cookie == body
Server state
0
Verdict
—
State
—
Cookie copy
Body copy
Match · 200
Mismatch · 403
▶ Play
←
→
🔇 Unmute
Reset
Un
seel
.com · CSRF Double-Submit
Un
seel
.com · CSRF and the Double-Submit Cookie Defense, Step by Step