diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index 20725bd8c8..efc0587f05 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -144,12 +144,14 @@ $(document).ready(function() {
                 <form action="/cgi-bin/koha/members/memberentry.pl" method="get">
                     <input type="hidden" name="op" value="modify" />
                     <input type="hidden" name="borrowernumber" value="[% check_member %]" />
+                    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                     <button type="submit" class="new"><i class="fa fa-pencil"></i> It is a duplicate.
                     Edit existing record</button>
                 </form>
 
                 <form name="form" action="/cgi-bin/koha/members/memberentry.pl" method="post" autocomplete="off">
 				<input type="hidden" name="nodouble" value="1" />
+                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                 <button type="submit" class="new"><i class="fa fa-plus"></i> Not a duplicate.
                 Save as new record</button>
 			</div>
@@ -233,6 +235,7 @@ $(document).ready(function() {
 <input type="hidden" name="check_member" value="[% check_member %]" />
 <input type="hidden" name="borrowernumber" value="[% UNLESS opduplicate %][% borrowernumber %][% END %]" />
 <input type="hidden" name="nodouble"  value="[% UNLESS opduplicate %][% nodouble %][% END %]" />
+<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
 [% IF ( step ) %]<input type="hidden" name="step"  value="[% step %]" />[% END %]
 [% IF ( opadd ) %]<input type="hidden" name="op" value="insert" />
 [% ELSIF ( opduplicate ) %]
diff --git a/members/memberentry.pl b/members/memberentry.pl
index 32b2402258..413db97a74 100755
--- a/members/memberentry.pl
+++ b/members/memberentry.pl
@@ -24,8 +24,8 @@ use warnings;
 
 # external modules
 use CGI qw ( -utf8 );
-# use Digest::MD5 qw(md5_base64);
 use List::MoreUtils qw/uniq/;
+use Digest::MD5 qw(md5_base64);
 
 # internal modules
 use C4::Auth;
@@ -42,6 +42,7 @@ use C4::Form::MessagingPreferences;
 use Koha::Patron::Debarments;
 use Koha::Cities;
 use Koha::DateUtils;
+use Koha::Token;
 use Email::Valid;
 use Module::Load;
 if ( C4::Context->preference('NorwegianPatronDBEnable') && C4::Context->preference('NorwegianPatronDBEnable') == 1 ) {
@@ -281,6 +282,14 @@ if ( ( defined $newdata{'userid'} && $newdata{'userid'} eq '' ) || $check_Borrow
 $debug and warn join "\t", map {"$_: $newdata{$_}"} qw(dateofbirth dateenrolled dateexpiry);
 my $extended_patron_attributes = ();
 if ($op eq 'save' || $op eq 'insert'){
+
+    die "Wrong CSRF token"
+        unless Koha::Token->new->check_csrf({
+            id     => C4::Context->userenv->{id},
+            secret => md5_base64( C4::Context->config('pass') ),
+            token  => scalar $input->param('csrf_token'),
+        });
+
     # If the cardnumber is blank, treat it as null.
     $newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/;
 
@@ -679,9 +688,18 @@ $template->param(
   category_type =>$category_type,
   modify          => $modify,
   nok     => $nok,#flag to know if an error
-  NoUpdateLogin =>  $NoUpdateLogin
+  NoUpdateLogin =>  $NoUpdateLogin,
   );
 
+# Generate CSRF token
+$template->param(
+    csrf_token => Koha::Token->new->generate_csrf(
+        {   id     => C4::Context->userenv->{id},
+            secret => md5_base64( C4::Context->config('pass') ),
+        }
+    ),
+);
+
 if(defined($data{'flags'})){
   $template->param(flags=>$data{'flags'});
 }