In the era of RESTful services and rich internet applications it's important to find security solutions that don't impose unnecessary state or computation on servers. I previously wrote a post on stateless session ids. Let's have a look at how we can protect against cross-site request forgeries (CSRF) without server-side state. CSRF Basics Forged requests are nasty attacks. They rely on the fact t
![Stateless CSRF Protection](https://cdn-ak-scissors.b.st-hatena.com/image/square/40d9012946e46b7bb352195e89d58e03fe975832/height=288;version=1;width=512/http%3A%2F%2F4.bp.blogspot.com%2F-g5KN7XG2nDE%2FTwcaplSiRYI%2FAAAAAAAAAl4%2FzlnEOm-ZbEM%2Fw1200-h630-p-k-no-nu%2Fcsrf.png)