title: Is comparing a session value and a hidden form enough to prevent CSRF?
body: <p>So the "typical" CSRF protection method is storing a nonce in a session and in a hidden form element. Is it possible for an attacking website to first scrape the target form using the victim's session, getting the hidden form token, and then send the token in their own form element? Testing this myself, it validates. I am just curious if it is possible for a bot to scrape the page and obtain the nonce.</p>
  
  <p>If this is possible, then how can you protect against this type of attack?</p>