CSRF Protection: Methods to send CSRF token for each request

Question

My initial code generated tokens for the requests that could alter state of my database, like CRUD operations. The token was generated for each request. Sent to client side in JSON-format along with other data and I expected this token to be returned with the request and changed it after completion of the request. But, as I implemented it to only parts of my code (CRUD operations), I was told to redo it and make it web-app wide. I think the best way to do this is with filters.

My problem is, how do I make the client send "the token" for each request? Do I set it in cookies? What are my options? Please advice.

Answer 1

best way is , all links should be GET request, and within get requests no modification should be made to application state. So for GET requests there will be no need for CSRF tokens.

For POST request s which make modifications in application state you have to generate, csrf hidden fields in your forms and validate the token in server during form submit.