You have to supply a CSRF token when calling sente/make-channel-socket-client!, and make sure that this token is validated with csrf-token-fn function that's passed to sente/make-channel-socket-server!. That's it.

oh so I can decide what both the parts are … sweet. That’s a really great explanation @U2FRKM4TW - thanks!!

Maybe you already solved this, but let me add some details. I use the default csrf-token implementation in my ring application. On the server side, I don't really have to do anything since the csrf token for the session is read is added by the server to the request, so it can be checked by Sente. On the client side, I am passing this token as part of the html page, and it gets read by the client from there and passed to Sente when creating the connection. This is what the line 69 you quoted does.

The default csrf-token-fn looks like this and should be fine:

(fn [ring-req]
  (or (:anti-forgery-token ring-req)
      (get-in ring-req [:session :csrf-token])
      (get-in ring-req [:session :ring.middleware.anti-forgery/anti-forgery-token])
      (get-in ring-req [:session "__anti-forgery-token"])
      #_:sente/no-reference-csrf-token
      ))