CSRF protection with javascript?

Can i protect from 开发者_运维百科CSRF by generating csrf token clien-side with javascript and setting from javascript cookie with this token and adding this token to post request?

server-side: check cookie[token] === post[token]

No, what is to stop an attacker from doing the same thing? The server needs to own one of the credentials.

I don't believe this would work. An attacker could just replicate your algorithm for generating the token and send in a valid value. You want to set the value on the server and ensure that the value can not be tampered with.

If you use PHP with JavaScript, then there is maybe a way to protect it, have a look at the OWASP CSRFGuard Project, but i had not a deep look on it, just found this

project implementing CSRFGuard style solution for PHP and JavaScript.

But really, i don't know if this is a safe implementation or not...

I know that some people on OWASP are working on getting the ESAPI ready for JavaScript (thats what Chris Schmidt ist talking about in this Video ) but I don't know how far they are at the moment, have a look at esapi.org