Preventing form submissions from another source is a solved problem, and using a nonce is one of the recommended methods.
The good news is that many web development frameworks already have pre-built mechanisms to prevent XSRF attacks, and they do so by ensuring that posts come from your own domain. Again, using a nonce is one of those methods.
From the OWASP page on XSRF:
- Add a per-request nonce to URL and all forms in addition to the standard session. This is also referred to as "form keys". Many
frameworks (ex, Drupal.org 4.7.4+) either have or are starting to
include this type of protection "built-in" to every form so the
programmer does not need to code this protection manually.
- TBD: Add a per-session nonce to URL and all forms
At the bottom of the OWASP page are several references including links to already available mechanisms for addressing this, including the OWASP CSRF Guard, which uses J2EE, .NET, and PHP filters that append a unique request token to each form and link in the HTML response in order to provide universal coverage against CSRF throughout your entire application.