Based on the risk (determined by manual verification) of whether the
form submission performs a sensitive action, the addition of anti-CSRF
tokens may be required.

These tokens can be configured in such a way
that each session generates a new anti-CSRF token or such that each
individual request requires a new token.

It is important that the
server track and maintain the status of each token (in order to reject
requests accompanied by invalid ones) and therefore prevent
cyber-criminals from knowing, guessing or reusing them.

_For examples
of framework specific remediation options, please refer to the
references._