title: CSRF token generation
body: <p>This is a question about generating CSRF tokens.</p>
  
  <p>Usually I'd like to generate a token based off of a unique piece of data associated with the user's session, and hashed and salted with a secret key.</p>
  
  <p>My question is in regards to generating tokens when there is NO unique user data to use. No sessions are available, cookies are not an option, IP address and things of that nature are not reliable.</p>
  
  <p>Is there any reason why I cannot include the string to hash as part of the request as well?
  Example pseudocode to generate the token and embed it:</p>
  
  <pre><code>var $stringToHash = random()
  var $csrfToken = hash($stringToHash + $mySecretKey)
  &lt;a href="http://foo.com?csrfToken={$csrfToken}&amp;key={$stringToHash}"&gt;click me&lt;/a&gt;
  </code></pre>
  
  <p>Example server-side validation of the CSRF token</p>
  
  <pre><code>var $stringToHash = request.get('key')
  var $isValidToken = hash($stringToHash + $mySecrtKey) == request.get('csrfToken')
  </code></pre>
  
  <p>The string being used in the hash would be different on each request. As long as it was included in each request, the CSRF token validation could proceed. Since it is new on each request and only embedded in the page, outside access to the token would not be available. Security of the token then falls to the $mySecretKey being known only to me.</p>
  
  <p>Is this a naive approach? Am I missing some reason why this cannot work?</p>
  
  <p>Thanks</p>