These tokens must be checked for validity at the server before the request is processed, we can make use of OTP to create our nonce values. This prevention is necessary to avoid CSRF attacks, at our demo for example the URL below doesn't check if the user is logged in which enable attackers to CSRF.

<form method="POST" action="http://controller-aerogear.rhcloud.com/aerogear-controller-demo/otp" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>