Linked Questions

Ask Question
10 questions linked to/from Should I use CSRF protection on Rest API endpoints?
Hot Newest Score Active Unanswered
20 votes
2 answers
4k views

The Spring docs state: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-...
hotmeatballsoup's user avatar
  • 347
12 votes
2 answers
24k views

I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such ...
Anonymous Platypus's user avatar
  • 1,472
2 votes
1 answer
4k views

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
John Smith's user avatar
  • 23
1 vote
2 answers
1k views

We have api.example.com that communicates with app.example.com, a native Android app and an iOS app. We want to allow other third parties to communicate with the API too if they want, and as such we ...
Merlin Mason's user avatar
  • 111
135 votes
4 answers
135k views

Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
Igor Pomogai's user avatar
  • 1,453
90 votes
5 answers
119k views

For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends "X-Requested-By: whatever" and the server checks the ...
Mads Mobæk's user avatar
  • 1,003
20 votes
5 answers
21k views

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
Abe Miessler's user avatar
  • 8,175
2 votes
2 answers
3k views

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
srchulo's user avatar
  • 121
1 vote
0 answers
2k views

I am testing an application that send XML data as body in POST request. The application is not using any CSRF token Is there any way to perform CSRF in this case. XHR does not works in latest browsers,...
PenGeek's user avatar
  • 311
0 votes
2 answers
279 views

This application is not using any CSRF token and not even cookies to identify users on their server. All they do is use a authorization header to identify users. Since an attacker doesn't know value ...
Jack's user avatar
  • 1