javascript - Do I need to enable CSRF protection? -
if none of post endpoints in api server consume application/x-www-form-urlencoded or multipart/form-data , need concerned csrf? understanding, csrf can executed through form-backed post requests. other kind of request requires use of xmlhttprequest , won't go through because of same origin policy. sure, can send json forms in modern browsers. applies application/x-www-form-encoded applies equally other form data encoding types. moreoever - there no guarantee support more types won't added in future there's that.