Report question

Question: CSRF protection by storing nonce in Session variable and form