title: Simple CSRF protection using nginx alone
body: <p>I have an nginx server serving plain HTML and JS files.</p>
  
  <p>The js code then calls various REST API to GET/POST data from API servers.</p>
  
  <p>If nginx receives a request for /api/ location, it forwards the request to another server which handles all the APIs.  This api server is built in Ruby on Rails.</p>
  
  <p>Since all my plain HTML pages are delivered by nginx directly, I cant have server side sessions while they are rendered.</p>
  
  <p>What can I do to prevent CSRF attacks?</p>