Hello, On 03/12/2017 03:49 PM, Mathieu Lirzin wrote: > Sensitive requests should be done with an > authentification mechanism which is not determined yet. I currently > have no experience with any and lack the knowledge to properly choose > one.
I’m new to Guix and Scheme and no expert in Web programming, but in order to prevent CSRF and in order not to rely on JavaScript, the server should run with HTTPS (of course) and · use a secret session token and · send a customized Web page to the client adapted so that each link and form to the server includes the session token as a GET or POST parameter. An alternative is Basic Access Authentication with HTTPS or Cookies with HTTPS but they are vulnerable to CSRF. See stackoverflow, for example https://stackoverflow.com/questions/21357182/csrf-token-necessary-when-using-stateless-sessionless-authentication Maybe others don’t take such a strong stance against JavaScript and prefer another method, but I believe JavaScript does not belong in the Web. Regards, Florian
