security - Tricky question for good understanding of CSRF -

my friend , have pari beer.

from wikipedia:

requiring secret, user-specific token in form submissions , side-effect urls prevents csrf; attacker's site cannot put right token in submissions

the atacker can use browser cookies indirectly, can't use them directly! that's why can't put cookies link using document.write()

let how logout link generated. secure way? can request faked?

function logout(){      echo '<a href="?action=logout&sid='.htmlspecialchars($_cookie['sid']).'>logout</a>'; } 

sid session id, generated every session

on server side, following checking performed:

$_get['sid']==$_cookie['sid'] 

absolutely not! never use session identifiers csrf protection.

as far why? well, answer simple. doing opens door session hijacking attacks. imagine copies , pastes link reason email or onto web. now, person on other end of email has session identifier of session. sure, if click link won't activate session, knows doing still able use it.

and don't use secret cookie either. cookies transmitted on every request. mere existence of cookie not verify user intended make request.

how instead? follow owasp recommendations. use unique, random token that's issued on each request , associated session. verify token valid on submission , invalidate token! should one-time-use token only. have submitted form, , not attached link directly...