We have react SPA application which call a back REST API. According to this paper (section 4.1) it is recommended to make a pre-session and then implement token-based CSRF protencion to stop login CSRF attacks.
The way we are thinking to solve this problem is to create and endpoint in the backend that returns a token in a JSON which encodes information about the IP of the client. Then, the frontend takes this token and adds it to the login form as a hidden input. Then, when the login process starts the backend validates that the IP in the token contained in the hidden input corresponds to the client IP that requested for login.
This have some problems, as stated in these answers
Our approach is different from the one stated in the paper. What is the correct approach to mitigicate login csrf in this scenario? How can I make a secure pre-session as stated in the paper?