title: Where to store CSRF token - ViewState or Session?
body: <p>I've been looking into the <a href="https://www.youtube.com/watch?v=eWEgUcHPle0" rel="nofollow noreferrer">CSRF</a> vulnerability and how to fix it in .NET application.</p>
  
  <p>Based on my research here is the pseudo algorithm I need to do:</p>
  
  <ol>
  <li>Check request for CSRF token in the request cookie, if it is not there, create one
  on the server. </li>
  <li>Once the token is created, add the token to the
  response cookie to send back to client. Client sends this CSRF
  token for all future request cookie.</li>
  <li>When server receives a request and it
  sees the CSRF cookie, the server validates against its stored CSRF
  token value. </li>
  <li>When it matches, then business as usual, if the values
  don't match then stop the request.</li>
  </ol>
  
  <p>My question is in step #3, I'm using ASP .NET web form;  I can store this CSRF token in either Session or a ViewState.  </p>
  
  <p>I don't want to use ViewState because all the pages in our application have to support EnableViewState="true".  If not, the ViewState content is wiped out on each and every post-back call.</p>
  
  <p>Can I use Session in this situation? Does it compromise the fix if I use Session instead of ViewState?</p>