title: How to reliably secure public JSONP requests?
body: <p>I'm trying to find if there's a good way to prevent CSRF on a javascript widget embedded on customers' websites.</p>
  
  <p>The widget would enable end users to make requests against our customers' accounts via JSONP to a a PHP server which proxies those requests to our (non-public) API.</p>
  
  <p>To this point, I haven't come up with a surefire way to ensure all requests are coming from only our customers' websites. Some ideas I've had:</p>
  
  <ul>
  <li>Tokens generated on the server side and passed back along with each subsequent JSONP request (not sure how to authenticate the initial request though, since the first token would be readable in JS and anyone could request the 'next' token)</li>
  <li>Checking the Referer header (unreliable, can be spoofed or simply not passed by the browser)</li>
  <li>Using SSL (would of course help but not solve the problem of CSRF)</li>
  </ul>
  
  <p>Is this at all possible? I've come across <a href="http://www.fotomoto.com/home/tour" rel="nofollow">Fotomoto's widget</a> which seems to allow the same type of functionality we are looking for, but am not sure how they're doing it.</p>