How can I use CSRF tokens provided by the play framework (play-2.2.3) with a PHP front-end?

Question

I am using play-2.2.3 to develop APIs. These APIs are accessed by a PHP/JQuery front-end. Simple example would be a resetPassword API. From the PHP, when I call the reset password API, it should be protected by a CSRF token so that someone cannot simply call that API and reset someone else's password. Short of rendering the form using Scala (provided by Play-2.2.3), is there a way to manually have single-use server-side tokens which appear as hidden form fields in the reset password form and get verified in the post request by the server on submit of the form?

Answer 1

Figured out how to do this.

1. On the play side, do NOT put any csrf settings in the application.conf
2. Use the @AddCSRFToken annotation on a method that will set a cookie called PLAY_SESSION=.....-csrfToken=........
3. In the API calls that need to be validated pass the PLAY_SESSION cookie entirely, AND in the queryString, pass the csrfToken=......