title: how to generate and validate csrf tokens
body: <p>what is the best way to generate a csrf token and verify. From what i have been able to gather, even if you have a hidden form field in a "post" form a hacker can simply get that form using ajax, take the csrf token and send another request to the site to submit the form.</p>
  
  <p>And if we are to check the headers sent to us... then the hacker could simply send the csrf token to a server side script that will then emulate the http headers.</p>
  
  <p>So how does one actually generate and verify csrf tokens?</p>