I have an online checkout with a multi step form and the form data should survive a page refresh. I am storing the form steps in an ETS table.

I don’t have any user auth - guests always checkout anonymously. Is it ok to use the csrf token to uniquely identify and store user activity? Or should I generate a unique id and store it in the session with a plug?

  def mount(_params, session, socket) do
    checkout_id = Map.get(session, "_csrf_token")

    {personalise, delivery, payment, current_step} =
      case :ets.lookup(:checkouts, checkout_id) do
        [{_checkout_id, {_, _, _, _} = form}] ->
          form

        _ ->
          form = {%Personalise{}, %Delivery{}, %Payment{}, 1}
          :ets.insert(:checkouts, {checkout_id, form})
          form
      end

    {:ok,
     socket
     |> assign(checkout_id: checkout_id)
     |> assign(step: current_step)
     |> assign(personalise: personalise)
     |> assign(delivery: delivery)
     |> assign(payment: payment)}
  end

Thanks