CSRF and double posting

Ah, I think the clouds have lifted (finally). And of course they are all very different things.

1. CSRF
Yes, the CSRF token has to be posted in the form and then compared to the cookie, to see if the source of the form is genuine or not. If the source is not genuine they will not match. This has nothing to do with authorization or sessions.

2. Double clicking
Double clicking or double posting has nothing to do with CSRF. It is an entirely separate issue.

3. Sessions
Sessions are purely about authorisation and have nothing to do with authentication or csrf.

4. Authentication
Has nothing to do with authorisation, csrf or double clicking :-)

I never realized before how important cookies actually are, and how important browser security of those cookies is either.

Anyway, I am much clearer on the whole issue now, thanks Skunkbad for your input, comments and thoughts. I am really quite delighted with Firefox now and have made it my default. Will do the same in the office tomorrow.

Best wishes,

Paul.