3 ms·
CSRF protection: * Use SameSite cookies (unfortunately, not yet supported by all browsers) * Don't accept application/x-www-form-urlencoded, multipart/form-da
by mwpmaybe 10y ago
CSRF protection:
* Use SameSite cookies (unfortunately, not yet supported by all browsers)
* Don't accept application/x-www-form-urlencoded, multipart/form-data, or text/plain at your endpoints, or
* Use CSRF tokens if you need to accept server-side rendered HTML forms