How to best prevent CSRF attacks in a GAE app?

Question

So, what is the best way to prevent an XSRF attack for a GAE application? Imagine the following:

1. Anyone can see a user\'s public object, and the db.Model id is us

Answer 1

In server's response displaying the form create a magic hash (based on client ip + date/time + random salt, whatever). Put it into a cookie and store somewhere on the server. During submit action handling check the cookie hash against the database entry.

If there's no such hash or it's different, reject the submission.

After successful submit you can remove the hash entry, change it's state to submitted - whatever suits you.

That method should protect you in many cases, but surely is still not 100% bulletproof.

Do a search for articles on CSRF, maybe you'll find some good answers on this Stack Overflow thing. ;)

Don't do any referrer checks or client ip validations - it's too error-prone (the referrer information might be cleared by the user agent, a proxy or by user's preferences) and client's IP might change between the form creation and submission - don't punish the user for dynamic IP address allocation.