2 ms·
> In my opinion, it is MUCH easier to get a CSRF vulnerability It's simple (though perhaps non-trivial) to protect against XSRF these days, especially if you'r
by mwpmaybe 10y ago
> In my opinion, it is MUCH easier to get a CSRF vulnerability
It's simple (though perhaps non-trivial) to protect against XSRF these days, especially if you're securing a JSON API, with:
1. the SameSite cookie option (Chrome-only for now)
2. double submit cookies (mentioned in the article)
3. filtering by the Accept request header, i.e. blacklist application/x-www-form-urlencoded, multipart/form-data, and text/plain, or whitelist application/json (protects against non-XHR, form-based attacks; only appropriate for JSON APIs)
4. CORS, i.e. disallow cross-origin requests, which is the default when no Access-Control-Allow-Origin response header is present (protects against XHR attacks; only appropriate for JSON APIs)