I generate a random anti-CSRF token per session and store it in a cookie (with the
http_only flag set). Then I add that token to forms (in a hidden input field) and links.
When receiving a request on the server, I check that the cookie and the anti-CSRF token field of the form or link exist and that the two values are the same; if not, it is considered a CSRF attack and the request is rejected with a proper message.
Is this mechanism safe/sufficient as a minimum? (That is to say, in the absence of security holes in the browser.)
I think that an attacker can't read or set the cookie of a domain that he doesn't own, so he can't forge a request that has the same token.