Contents
Is CSRF protection necessary?
So, as a rule of thumb, whenever you use cookies and sessions for requests to validate a user, i.e. to confirm or establish trust in a user, use CSRF protection. Since you want to establish trust in your user when he signs up, the same applies. Unfortunately, CSRF attacks are not limited to only that.
Should I use CSRF protection on REST API endpoints?
This use of cookies doesn’t directly violate the statelessness requirement of REST because the server still isn’t tracking client-side state. Either way, the overall answer is simple: if you are using cookies (or other authentication methods that the browser can do automatically) then you need CSRF protection.
Do you need CSRF with API?
An API pretty much precludes CSRF, because its entire purpose is generally to allow 3rd-party entities to access and manipulate data on your site (the “cross-site” in CSRF). So, yes, I think as a rule any API view should be CSRF exempt.
Does REST API need CSRF token?
Yes, you don’t need CSRF protection when using a bearer scheme authentication as the browser does not automatically add the Authorization header to the request. You do need CSRF protection for cookies, basic, Windows, digest and client certificates authentication schemes as these are automatically added by the browser.
Is the REST API protected from CSRF attacks?
Since authentication is application-specific, and since the browser itself doesn’t know what the authentication token is, there is no way for a browser to automatically provide authentication credentials even if it is somehow tricked into visiting the API endpoint. As a result, a cookie-less REST endpoint is completely immune from CSRF attacks.
When do you need to use CSRF protection?
CSRF attacks depend upon this behavior. If you do not use cookies, and don’t rely on cookies for authentication, then there is absolutely no room for CSRF attacks, and no reason to put in CSRF protection. If you have cookies, especially if you use them for authentication, then you need CSRF protection.
Is the authentication provided by browser or REST API?
REST APIs can have state changing actions. Is the authentication provided by browser (not limited to cookies) – CSRF happens because authentication information is included in the request by browser irrespective of whether the request was started by the user, or some other open tab.
Is it safe to use REST API endpoints?
So, you can still safely avoid dealing with CSRF on your REST APIs. But your login / authentication server better be bullet-proof (and CSRF protected). Rest API endpoints have a very important difference from other requests: they are specifically stateless, and should never accept/use data from either a cookie or session.