If there were an easy, alternative secure solution then developers would already be using it. Implementing common anti-XSRF mechanisms like a session token in

If there were an easy, alternative secure solution then developers would already be using it. Implementing common anti-XSRF mechanisms like a session token in a form field or extra http header requires modifying every place your app communicates with the server. It’s anything but easy which is why so many apps/websites not built with XSRF in mind still have vulnerabilities.