2 ms·

I have implemented CSRF for the public API I work on and all PUT/POST requests require the CSRF token, not GET requests. In this case, the login form uses a PO

by Osiris 11y ago

I have implemented CSRF for the public API I work on and all PUT/POST requests require the CSRF token, not GET requests. In this case, the login form uses a POST request and thus must require a CSRF token to avoid an attack on users that aren't logged in.

kogir 11y ago
What stops an attacker from requesting the CSRF token?
- r1ch 11y ago
  Same-origin policy.
  - kogir 11y ago
    That only applies to browsers. I can request it from my server just fine. See https://news.ycombinator.com/item?id=11178922 https://news.ycombinator.com/item?id=11178922