Question

Reading OWASP CSRF prevention cheat sheet, one of the methods proposed to prevent these kind of attacks is the synchronizer token pattern.

If the session token is cryptographically strong, can it double as the csrf token as described in the following pseudocode?

Client:

<script>
dom.replace(placeholder, getCookie("session-cookie"))
</script>

<form>
<input type="hidden" name="csrf-cookie" value="placeholder-value"/>
<input type="text" />
</form>

Server:

if(request.getParameter("csrf-cookie") != user.getSessionCookie())
    print "get out you evil hacker"

The cookie is set with javascript on page load to prevent users from accidentally leaking the session cookie if they e.g. email a copy of the page to a friend.

Answer 1

Anything that cannot be retrieved by an external site can be used as a CSRF token. So contents of the session cookie is fine for this.