I had envisioned what I think is a more solid defense against CSRF ... I just haven't had time to build a proof. Earlier commenters have noted that each reques

I had envisioned what I think is a more solid defense against CSRF ... I just haven't had time to build a proof. Earlier commenters have noted that each request back to the server should include an unguessable token that cannot be derived by mining other pages on the site with cross-site AJAX requests. My hypothetical solution is to embed that token in the prefix to the hostname after logging into the given site. The token would then be sent in the Host: header for all dynamic requests. Step 1: You log in to www.somesite.kom. Step 2: You are then forwarded to dynXXXXXXXX.somesite.kom where XXXXXXXX represents a unique, dynamically-generated token tied to your session. The attacker must now know XXXXXXXX to properly form up a GET or POST request to attack your account. The site itself could then use relative URL's for dynamic content or could use the appropriate templating system to ensure that any dynamic URL's ( either in HTML markup or script text ) contain the generated hostname.