javascript - Do I need to enable CSRF protection? -
if none of post endpoints in api server consume application/x-www-form-urlencoded
or multipart/form-data
, need concerned csrf? understanding, csrf can executed through form-backed post requests. other kind of request requires use of xmlhttprequest
, won't go through because of same origin policy.
sure, can send json forms in modern browsers. applies application/x-www-form-encoded
applies equally other form data encoding types.
moreoever - there no guarantee support more types won't added in future there's that.
Comments
Post a Comment