Securing my App from Cross Site Request Forgery

Hi,

I am trying to secure my application from Cross Site Request Forgery. I did some reading on this and they say the best way to handle this is to set a session token and use a hidden variable on each page with the value from the session variable. Then on each request, compare the values and make sure they are the same and this should take care of CSRF.

I have a base class where I check to see if session("Token") = request.form("token") but request.form is always empty because all forms in asp.net submit to themselves.

Is there another way to get the value from the previous page or is there a better way to handle CSRF in ASP.Net 2.0?

Thanks
...