I'm writing a library to generate and check CSRF tokens.
I would like to do it without having to use sessions and/or cookies. What I've come up with is this:
A token generated from the current time and a unique token id (unix-timestamp.unique-token-id).
The token would then be hashed using the HMAC method. The returned value would be: hmac-hash.unix-timestamp.unique-token-id. This could then be hidden in a form.
The library would then test the returned token by extracting the HAMC hash, time and unique token id from it and then compare the returned HAMC hash to one generated using the returned time and unique token id.
As long as the HMAC secret on the server stays secret it should be secure or did I missed something?