javascript - Do I need to enable CSRF protection? -


if none of post endpoints in api server consume application/x-www-form-urlencoded or multipart/form-data, need concerned csrf? understanding, csrf can executed through form-backed post requests. other kind of request requires use of xmlhttprequest, won't go through because of same origin policy.

sure, can send json forms in modern browsers. applies application/x-www-form-encoded applies equally other form data encoding types.

moreoever - there no guarantee support more types won't added in future there's that.


Comments

Popular posts from this blog

android - Gradle sync Error:Configuration with name 'default' not found -

java - Andrioid studio start fail: Fatal error initializing 'null' -

html - jQuery UI Sortable - Remove placeholder after item is dropped -