title: Secure CSRF protection without sessions or database?
body: <p>i'm trying to implement secure CSRF protection to HTML login form,
  i know the best way to implement CSRF protection is storing random csrf_key in a session,
  but i want to add CSRF to my login &amp; register forms... and i do not want to store many sessions for any anonymous unregistered users...</p>
  
  <p>so i want to create the best secure posibble without using sessions or database, with only form hidden field /&amp; a cookie, and after the login i will use sessions csrf protection.</p>
  
  <p>my idea of secured user_storage only csrf:</p>
  
  <p>csrf_token= AES(ip+useragent+timestamp+random_data, csrf_aes_site_key)</p>
  
  <p>when csrf_aes_site_key is hard-coded in config file.
  and after every login/register i will decrypt the AES string + velidate that the ip&amp;ua is matching the request ip&amp;ua, and timestamp is not too match ahead, let say 5 min (if csrf_timestamp + 18000>=current_ts), and random_data is just randomness (and make sure that the same user will not get the same csrf_token if requested multiple times in the same ts)...</p>
  
  <p>so ... is it secure enough, is it good solution?
  if not, any other suggestions to solve this dilemma?
  thank!</p>
  
  <p><strong>EDIT:
  the implementation i just created, and it's working fine, but is it good enough?</strong></p>
  
  <p>full example:
  <a href="https://github.com/itaiarbel/aes_based_csrf_protection" rel="noreferrer">https://github.com/itaiarbel/aes_based_csrf_protection</a></p>
  
  <p>issue 1:
  user may take the csrf_token and submit to the form successfuly using the same token for the next 5min
  bug? what do i care if the user submit many times? as long as it not csrf attack...</p>
  
  <p>issue 2:
  if the page is left open for 5min, the user will faild login,
  (refrash login page automaticaly every 5 min? maby change it to 1h?)</p>
  
  <p>can you spot any specific security risk with this implementation? or can i assume this is a secure way of doing CSRF protection?</p>