That&#x27;s actually not always enough. For example, to fix this login CSRF on HN, you need a per-visitor secret an attacker can&#x27;t read (like a cookie) plus a form value <i>based on that secret</i>. Note it can&#x27;t be tied to the user account, because the visitor hasn&#x27;t logged in yet.<p>A random CSRF token on a login form is easily defeated - the attacker just requests a valid one and uses it when submitting the CSRF form.