I edited my Cross-Site Request Forgery countermeasures research into a stand-alone article, including recommendations reusable by other projects.

I edited my Cross-Site Request Forgery countermeasures research into a stand-alone article, including recommendations reusable by other projects.

tl;dr: no need for tokens or keys, modern browsers tell you if a request is cross-origin!

Cross-Site Request Forgery

Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.

(words.filippo.io)