title: Double Submit Cookies and multiple tabs?
body: <p>The <a href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Double_Submit_Cookie" rel="nofollow noreferrer">double-submit cookie</a> mechanism requires the use of cookies. However, cookies are shared across all browser tabs. <strong>How do you implement this mechanism without breaking the back button and browser tabs?</strong></p>
  
  <p>Meaning: if all tabs use the same cookie to store the CSRF token, every time a new tab is opened it would clobber the cookie value of all older tabs. When the forms in those older tabs are then submitted they will fail with a token mismatch.</p>
  
  <p>On the other hand, if I use a separate cookie per tab how will the server know which cookie to look in? And also, if you need to use a hidden field to point to the cookie name, does it somehow open you up to new security attacks (since attackers that use CSRF can change form values)?</p>
  
  <p><strong>UPDATE</strong>:</p>
  
  <ul>
  <li>The implementation needs to be stateless/RESTful. There is no server "session".</li>
  <li>You can assume I control all sub-domains, so attackers won't be able to write their own cookies.</li>
  </ul>