CSRF and double posting

Looking at this I think it is a bug in Chrome. The other browsers simply don't "re-post" as long as no response has been sent from the server.

Maybe you could flag a CSRF token as sent in a session variable. When the second POST comes, check if the token has been flagged. If it has been flagged, don't process and continue to the intended destination.

As for hiding the button, CSS alone should work

Code:

input[type=submit]:active {
   display: none;
}