Preventing form submissions from another source is a solved problem, and using a nonce is one of the recommended methods.
The good news is that many web development frameworks alrady have pre-built mechanisms to prevent XSRF attaks, and they do so by ensuring that posts come from your own domain. Again, using a nonce is one of those methods.
From the OWASP page on XSRF:
- Add a per-request nonce to URL and all forms in addition to the standard session. This is also referred to as "form keys". Many
frameworks (ex, Drupal.org 4.7.4+) either have or are starting to
include this type of protection "built-in" to every form so the
programmer does not need to code this protection manually.
- TBD: Add a per-session nonce to URL and all forms
At the bottom of the OWASP page are several references including links to already-agailable mechanims for addressing this, including the OWASP CSRF Guard , which is J2EE, .NET, and PHP Filters which append a unique request token to each form and link in the HTML response in order to provide universal coverage against CSRF throughout your entire application.