<p dir="auto">From the discussion in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="140352653" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/18115" data-hovercard-type="issue" data-hovercard-url="/symfony/symfony/issues/18115/hovercard" href="https://github.com/symfony/symfony/issues/18115">#18115</a> :<br>
we should add the Double Submit Cookies CSRF prevention strategy as described by<br>
<a href="https://www.owasp.org/index.php/CSRF_Prevention_Cheat_Sheet#Double_Submit_Cookies" rel="nofollow">https://www.owasp.org/index.php/CSRF_Prevention_Cheat_Sheet#Double_Submit_Cookies</a></p>
<p dir="auto">If doable, this should be the default CSRF prevention strategy used in symfony SE</p>
<p dir="auto">It would be nice add cookies csrf token storage. Use case: we are having form which available for anonymous users (and bots like googlebot). Session starts on each time when this page open. And too much files was generated with session data.</p>