I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret that accepted form client afterwards. My question is - how can we prevent a malicious user from attacking by CSRF? Note that i'm not seeking for a specific implementation info such as "use AntiForgeryToken()". Any related information will be helpful. Thanks a lot.
in MVC or any other stateless web app
Your terminology is rather confused. Any user facing application is a hierarchy of MVC patterns. MVC is rarely stateless, indeed in the cases where it is stateless (serverside) there's very little risk from CSRF. Your question is really about session management.
In the absence of session management, the only way I know of to solve the problem is via OTPs - but arguably this is session management since the OTP must be retained until it used, and the information about the OTP modified when it is used.
If you consider the case for pay-per-click advertising - you're not relying on any information being supplied by the user, however you do need to keep track of counts - hence the application is no loinger stateless. You can avoid the need to maintain a session by using (for example) browser fingerprinting - but you then need to maintain a list (state) of fingerprints already considered to have 'clicked' - the application is no longer stateless with regard to the client device and there is a session. It's really not that different from dropping a cookie on the browser and reading it back later.
Given that it also solves many other problems, maintaining a session serverside is the best solution.