For some more practical advice, this is the point of using crumbs, kids. If you pass a unique verifiable value with your request you can avoid this sort of thi

For some more practical advice, this is the point of using crumbs, kids. If you pass a unique verifiable value with your request you can avoid this sort of thing. This is also true of any GET request that can change user data (which you shouldn't be doing anyway). A typical way to do this is to hash some secret for the user with a salt and a timestamp. The timestamp and the secret are passed with the request and can be used to verify the secret.