kyledrake/neocities-web — pull request #4 by mikeycgto (2013-06-22 16:06:45+00:00)
Title: Updates for CSRF protection

The session itself is already secured (via an HMAC). We can just store a random token and check that the token is present and correct in the POST parameters.

Can add check against something like `request.headers['X-CSRF-Token']` for easier AJAX as well.