title: How to check CSRF token serverside if i am not using session cookies?
body: <p>In our current project, we implement persistent sessions by using cookies. When the user logs in a session hash is generated and sent via a user cookie. On every page load that is checked with the corresponding session entry in the database and the user is authenticated. </p>
  
  <p>In the past if i had to do csrf token check, i would normally have assined a session variable for the particualar session. And on every subsequent ajax calls i would have matched the csrf token sent as a custom header in the ajax request, with the session variable. </p>
  
  <p>However for the present project i cannot find a proper way to do this. A secure hash can be created and can be added as a custom header or as a hidden input field or even as a parameter in the ajax request. But how do i validate it on the client side ? </p>
  
  <p>For the time being i am doing something like <code>str_rot13(base64_encode(some_secret_key))</code> and sending it as the csrf token.</p>
  
  <p>Then on the server side i am doing the reverse, obtaining the secret_key and matching it with the secret key that i have configured for my app. This however doesn't seem at all secure to me. I have thought of using <code>openssl_random_pseudo_bytes(32) , openssl_random_pseudo_bytes(16) etc..</code> But again, thats a hash i would be generating. How would I validate it on the server side?! </p>
  
  <p>What can be some best practices that i can adopt, given the user authentication mechanism that i am following?</p>