1. Embed an ephemeral encrypted token (https://owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Encrypted_Token_Pattern https://owas

1. Embed an ephemeral encrypted token (https://owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Encrypted_Token_Pattern https://owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF...) in the HTTP response header that's signed with an HMAC-SHA-256 signature. 2. Sign sensitive requests similar to how Amazon does for AWS API requests (http://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html http://docs.aws.amazon.com/general/latest/gr/signing_aws_api...) -- just make sure your signature is secure (http://www.daemonology.net/blog/2008-12-18-AWS-signature-version-1-is-insecure.html http://www.daemonology.net/blog/2008-12-18-AWS-signature-ver...). 3. Use client-side certificates by using the HTML5 keygen element to have the browser generate the client's public/private key pair, and then have the server sign the client's public key (http://security.stackexchange.com/questions/27961/should-the-keygen-element-be-used-to-create-a-certificate-for-mutual-auth-tls-w/27967#27967 http://security.stackexchange.com/questions/27961/should-the...). 4. All of the above.