To mitigate CSRF on a form, send the user a randomly generated, long, unique token every time the form is rendered. Put it in a hidden input.<p>Your server must expect the POST to answer back with a valid csrf token. Otherwise, the request results in an error and doesn&#x27;t go through. Attacker pages won&#x27;t know anything about the csrf token, so they can&#x27;t forge the form.