title: CSRF protection of GET links
body: <p>I need to add CSRF protection to a web application.</p>
  
  <p>Problem is in the fact that the app relies heavily on links (GET requests that is) to make changes in the database. </p>
  
  <p>Links are generated using a class, so I could easily add an extra parameter for CSRF token to each link. </p>
  
  <p>However, I understand that CSRF token in a GET request might not be a good enough protection.</p>
  
  <p>Note that app is only available over HTTPS, so GET params can not be exposed/stolen during client/server communication (but history stealing issue remains).</p>
  
  <p>Could GET CSRF token param be considered "safe enough" in this setting?</p>
  
  <p>If not, what is the best way to solve this problem? Only thing that comes to my mind is to wrap each of my links into a form (ether explicitly, or creating form onSubmit using JavaScript).</p>