From 5d5492da20b2ea711d1c8d55b0a36967f7b632ec Mon Sep 17 00:00:00 2001 From: vvmuysew <56600896+vvmuysew@users.noreply.github.com> Date: Wed, 13 Mar 2024 13:56:42 +0100 Subject: [PATCH] Add a missing " in the pseudocode (#1361) --- .../Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md b/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md index 923cd0e0f7..ce0d1e6a44 100644 --- a/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md +++ b/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md @@ -104,7 +104,7 @@ hmac = hmac("SHA256", secret, message) // Generate the HMAC hash csrfToken = hmac + "." + message // Combine HMAC hash with message to generate the token. The plain message is required to later authenticate it against its HMAC hash // Store the CSRF Token in a cookie -response.setCookie("csrf_token=" + csrfToken + "; Secure) // Set Cookie without HttpOnly flag +response.setCookie("csrf_token=" + csrfToken + "; Secure") // Set Cookie without HttpOnly flag ``` ### Naive Double-Submit Cookie Pattern (DISCOURAGED)