csrf/double_submit_naive

Naive Double-Submit Cookie pattern vulnerability

The Naive Double-Submit Cookie pattern is bypassable by an attacker who can write cookies on the target domain (via vulnerable sibling subdomain, DNS takeover, or plaintext-HTTP cookie injection on non-__Host- cookies). This pattern should not be used for new code. It uses a cryptographically strong random value as both a cookie and a request parameter, but this provides minimal protection and remains vulnerable to cookie injection attacks. Always prefer the Signed Double-Submit Cookie pattern with session-bound HMAC tokens.