the token could be retrieved via dynamic script tags… a way to prevent that is by requesting a new token via AJAX when the page is loaded… on a normal form retrieval the hidden field should be blank.

I would say enforce a password which would solve any CSRF problem. So for example if you are accept a site request on your OpenID provider site do not allow a user to save the password. Make them enter the password on each request. The only way an attacker could exploit this is to either send the valid password or ride the user’s session.

Let me know if that helps or please provide me with a brief description on how your site works and I’ll let you know the possible attack vectors and prevention.

Generally I have to try and avoid using state as much as possible to try and maintain a strict REST model.

http://www.thespanner.co.uk/wp-content/uploads/2007/06/openid.zip

Description about it here:-
http://www.thespanner.co.uk/2007/06/29/openid-security-issues/

This attack is quite difficult to protect against as it uses a new window to perform the attack. If you follow the advice in the post, you will be a much more difficult target.

You assign the user a session which you already know the answer to. That’s why I’ve included expiry dates on the tokens.

I hope I was clear enough. We might continue the discussion here: http://sla.ckers.org/forum/read.php?2,13324

I find the whole security=restricted thing very interesting because the feature is also a security hole and to protect it you create a catch 22 situation e.g. You need javascript to execute the token, you need to stop javascript to prevent the frame breaker

My other post deals with the javascript/php creation and includes source code if you want to take a look:-
http://www.thespanner.co.uk/2007/08/15/random-javascript-and-php-generation/

obfuscating js

The code could be easily be expanded upon to include other generation methods if needed.

Let me know if you can break it

Just curious, how are you generating the javascript code to create nonce?

One more thing. Pdp had suggested using cookie value as the nonce in his essay. Even if we are paranoid about not allowing cookie value to be cached in the browser (and other similar issues), wouldn’t a simple mutated form of cookie value be an equally good nonce?

p.s.:At first look, I thought you are obfuscating some JS code

Let me know if you can break it