Validate Origin of FORM POST to ensure it came from same server/app

Question

I want find a platform/language agnostic solution to ensuring the origin of a FORM POST is from an expected source. I.e. Page1.aspx posting to Page2.php within the same web site.

Specifically what I am attempting to do here is to prevent request forgery.

Answer 1

Use a hidden field in your form, which contains a token your app generated. Store the token in the user session. When the form is submitted, your app will check that the value of the hidden field is identical to the value stored in the user session.

If it is identical, then you know the submitted form comes from where it is expected to come.