Note to self: Hackernews had this blog post posted.

• https://blog.miguelgrinberg.com/post/csrf-protection-without-tokens-or-hidden-form-fields
• https://words.filippo.io/csrf/
• Use a modern approach for cross-site request forgery protection rails/rails#56350

see https://github.com/golang/go/blob/master/src/net/http/csrf.go which was introduced in GO 1.25

Maybe there is something we can adopt?