how to generate and validate csrf tokens

what is the best way to generate a csrf token and verify. From what i have been able to gather, even if you have a hidden form field in a "post" form a hacker can simply get that form using ajax, take the csrf token and send another request to the site to submit the form.

And if we are to check the headers sent to us... then the hacker could simply send the csrf token to a server side script that will then emulate the http headers.

So how does one actually generate and verify csrf tokens?