title: Do I need to use a 'nonce' token in ASP.NET WebForms to guard against CSRF?
body: <p>In an ASP.NET WebForms application which:</p>
  
  <ol>
  <li><p>Sets the <code>ViewStateUserKey</code> to the session ID via</p>
  
  <pre><code>protected override void OnInit(EventArgs e)
  {
      base.OnInit(e);
      if (User.Identity.IsAuthenticated)
          ViewStateUserKey = Session.SessionID;
  }
  </code></pre>
  
  <p>on the derived base page</p></li>
  <li><p>Uses only POSTbacks to perform any sensitive actions</p></li>
  <li><code>EnableViewStateMac</code> is always enabled</li>
  </ol>
  
  <p>Do I still need to implement a hidden form field value with a random token that is checked for on subsequent requests to mitigate against CSRF attacks?? </p>