I'm currently struggling with the implementation of CSRF in a web application. The application is (more or less) stateless. There is however a session that is kept in a (HttpOnly) cookie. As we use this cookie we are subject to CSRF. But as the session is the only state the application has, I'm wondering how I could do the CSRF protection.
My current approach is to hash the session information and use this as CSRF token. Thus I can recreate the token for validation based on the session and (almost) no session information is available to the JS code. But I kind of dislike the idea that there is a connection from session to CSRF token as CSRF tokens should be random.
I found this post on doing CSRF in a stateless application that focuses on generating the CSRF token in the JS code and sending it as cookie and header. This approach seems to be very reasonable. But client-side generation of the CSRF token seems to be rather uncommon and most guides only mention server-side generated tokens.
Thus I'm wondering if there are any drawbacks with the approach of generating the CSRF token on the client-side?