Hacker News Reader

First, use the correct HTTP verb: POST (or possibly DELETE). Googlebot only GETs.

Also as you note, destructive changes should be authenticated, whether by Basic Auth over TLS or the more common cookie tokens.

Fundamentally, authentication when someone tries to delete a thing needs to happen in server-side logic, not on the client side. The rest is flavouring.

Authentication should happen server side, but authentication need not happen at the time of delete. When deleting, you should be authorizing and validating, which can safely be done client side... but, if you are doing something server-side (e.g., a delete) you should also be doing it server side.

HTTP is stateless. You need to generate some kind of token that can be checked for each admin action a user takes.

Authentication, POST requests and CSRF tokens, at the bare minimum.

Basically do the exact opposite of everything they did. Doing authentication in client-side JavaScript is an absolute no-no. Using GET requests for things that have side effects (like deleting content) is another.

Don't authenticate on the client, it's that simple. Authenticate only server side.

Solution is to use a mature web framework that already solves this. ie. Django.