As a webserver: You don't. If the client is owned, that's not the server's problem. Related: https://paragonie.com/blog/2016/03/client-authenticity-is-not-serv

As a webserver: You don't. If the client is owned, that's not the server's problem. Related: https://paragonie.com/blog/2016/03/client-authenticity-is-not-server-s-problem https://paragonie.com/blog/2016/03/client-authenticity-is-no...