Does anyone see any downsides of doing the following to prevent CSRF?
- by Spines
I'm wondering if the following method will completely prevent CSRF, and be compatible with all users.
Here it is:
In the form just include an extra parameter that is: encrypted(user's userID + request time). Server-side just decrypt and make sure it's the right userID and the request time was reasonably recent.
Aside from someone sniffing the user's traffic, is this completely secure? Are there any downsides?