Reading OWASP encrypted tokens pattern they describe the flow as follow:
After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a nonce, using a unique key available only on the server. This token is returned to the client and embedded in a hidden field for forms, in the request-header/parameter for AJAX requests.
But where this token should be stored before and and after embedding it in hidden form and so on ...
If stored in the Cookies then we return to the 0 point where we are exposed to CSRF, and if stored in HTML5 Storage then it can be stolen by XSS.
Can you someone explain how this token helps preventing CSRF attack ?
The only way I see it is to authenticate everytime a request needs to be sent which is nonsense.