Explain the working of X CSRF Token.

The intention with sending a custom header such as X CSRF Token as well as a cookie is that the technique, called double submit, will mitigate CSRF if implemented properly. The way it works is that while cookies will be automatically sent with a forced request as in the case of CSRF, the custom header will not, stopping an attacker from forcing you, the victim, to not get attacked because the server will look for both values. Double submit is used in cases where the application doesn't want to keep track of the state of an anti-CSRF token.