Tricky question for good understanding of CSRF

Question

My friend and I have a pari for beer.

From wikipedia:

Requiring a secret, user-specific token in all form submissions and side-effect URLs prevents CSRF; the attacker's site cannot put the right token in its submissions

The atacker can use browser cookies indirectly, but he can't use them directly! That's why he can't put the cookies into the link using document.write()

Let us look how the logout link is generated. Is it secure way? Can this GET request be faked?

function logout(){
     echo '<a href="?action=logout&sid='.htmlspecialchars($_COOKIE['sid']).'>Logout</a>';
}

sid is a session ID, generated for every session

on the server side, the following checking is performed:

$_GET['sid']==$_COOKIE['sid']

Answer 1

Absolutely not! Never use session identifiers for CSRF protection.

As far as why? Well, the answer is simple. Doing so opens the door for session hijacking attacks. Imagine someone copies and pastes the link for some reason into an email or onto the web. Now, the person on the other end of the email has the session identifier of that session. Sure, if they click the link it won't activate the session, but someone who knows what they are doing will still be able to use it.

And don't use a secret cookie either. Cookies are transmitted on every request. So the mere existence of a cookie does not verify that the user intended to make the request.

How to do it instead? Follow the OWASP recommendations. Use a unique, random token that's issued on each request and is associated with the session. Then verify that the token is valid on submission and then invalidate the token! It should be a one-time-use token only. Have it submitted by the form, and not attached to a link directly...