title: How to make a cross-domain form CSRF and replay resistant?
body: <p>I'm contemplating making a project, but I'm wondering if cross-site request forgery would make it impossible to secure.</p>
  
  <p>Basically, I want to have a web service that generates a form using the usual tricks(JSON-P and iframes) on another domain's page. So WebService.example.com generates a form's HTML, and it's shown to the user on User.example.com</p>
  
  <p>This form, I assume will have to use the injected iframe trick to submit the form from javascript. Because anyone would be able to just get the same data from WebService.example.com, how can I ensure that it's actually only coming from User.example.com? Preferably, without having to have any server-side code running on User.example.com.</p>
  
  <p>Note, I'll be using ASP.Net for the WebService, but I'd like it explained in a language/framework agnostic manner</p>