Someone has asked the same question here: Should CSRF token without session cookie work? but the people answering seem uncertain. So, why does anyone need a cookie at all if they are using a token embedded in a form? They are both basically used for identification. I understand that CSRF tokens can get ruined when you hit the back button and ruin the DOM storing the token, but assuming that that is not an issue for your website, perhaps it's only a single page website, or perhaps a per-session CSRF guard token is being used. Why then could you not just use the token as a session identifier instead of a session-identifying-cookie?