The primary challenge in defending against CSRF is enforcing the use of your own forms. This can practically eliminate the likelihood of a successful CSRF attack by making a legitimate request extremely difficult to forge.