4 ms·
I'm not seeing any CSRF tokens (but I don't generally work with node, so correct me if I'm wrong). If your POST endpoints accept application/x-www-form-urlenco
by jhomedall 8y ago
I'm not seeing any CSRF tokens (but I don't generally work with node, so correct me if I'm wrong).
If your POST endpoints accept application/x-www-form-urlencoded or multipart/form-data, you will definitely want to add this. If you don't, it becomes trivial to rig up a website that will use your browser to trigger a POST to your internal endpoints.