new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

csrf/double_submit_signed

1 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Signed Double-Submit Cookie pattern requirements

The Signed Double-Submit Cookie pattern is the most secure implementation of the Double Submit Cookie technique. It requires: (1) A session-dependent value that changes with each login session (never use static values like user email or ID); acceptable session-dependent values include server-side session ID (PHP session-start, ASP.NET session) or a random value (UUID) within a JWT that changes every time a JWT is created - the session ID should never leave the server or be in plain text in the CSRF token; (2) A secret cryptographic key used to generate the HMAC hash, stored securely per Cryptographic Storage guidelines; (3) A random value for anti-collision purposes (cryptographically random) to ensure consecutive calls within the same second do not produce the same hash.

Give your agent this brain