Do I need CSRF protection for API?
So, yes, I think as a rule any API view should be CSRF exempt. However, you should still follow best practices and protect every API-endpoint that actually makes a change with some form of authentication, such as OAuth. CSRF attacks rely on cookies being implicitly sent with all requests to a particular domain.
Is CSRF possible in mobile application?
The cookies will not be shared with other applications using the same web viewer control. Anything loaded from the filing system will also be isolated from each other: Android and iOS have security controls so that apps can’t read other app’s data. Therefore CSRF is not likely within a mobile application.
How to prevent CSRF attacks with REST API?
Preventing CSRF attacks on a Single Page App with REST API 1 CSRF. Let’s start with Cross Site Request Forgery (CSRF). 2 XSS. Cross Site Scripting (XSS) is one of the most common and most dangerous attacks online. 3 SOP/CORS. 4 CSRF Tokens. 5 SameSite Cookies. 6 Separate Security Domains.
Is there an API that is not CSRF exempt?
An API pretty much precludes CSRF, because its entire purpose is generally to allow 3rd-party entities to access and manipulate data on your site (the “cross-site” in CSRF). So, yes, I think as a rule any API view should be CSRF exempt.
How does cross-site request forgery ( CSRF ) attack work?
Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user’s web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include all cookies including session cookies.
When do you need to use CSRF protection?
CSRF attacks depend upon this behavior. If you do not use cookies, and don’t rely on cookies for authentication, then there is absolutely no room for CSRF attacks, and no reason to put in CSRF protection. If you have cookies, especially if you use them for authentication, then you need CSRF protection.