title: Understanding CSRF
body: <p>I don't understand how using a 'challenge token' would add any sort of prevention: what value should compared with what?</p>
  
  <p>From <a href="http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet" rel="noreferrer" title="OWASP">OWASP</a>:</p>
  
  <blockquote>
    <p>In general, developers need only
    generate this token once for the
    current session. After initial
    generation of this token, the value is
    stored in the session and is utilized
    for each subsequent request until the
    session expires.</p>
  </blockquote>
  
  <p>If I understand the process correctly, this is what happens.</p>
  
  <p>I log in at <a href="http://example.com" rel="noreferrer">http://example.com</a> and a session/cookie is created containing this random token. Then, every form includes a hidden input also containing this random value from the session which is compared with the session/cookie upon form submission.</p>
  
  <p>But what does that accomplish? Aren't you just taking session data, putting it in the page, and then comparing it with the exact same session data? Seems like circular reasoning. These articles keep talking about following the "same-origin policy" but that makes no sense, because all CSRF attacks ARE of the same origin as the user, just tricking the user into doing actions he/she didn't intend.</p>
  
  <p>Is there any alternative other than appending the token to every single URL as a query string? Seems very ugly and impractical, and makes bookmarking harder for the user.</p>