Contents
How to prevent CSRF with JSON APIs?
So really it’s up to the server to check the post request, only allow content-type application/json and use correct origin policies to prevent CSRF with a JSON API. Remember CSRF is always dependent on the server to prevent the attack. Thanks for contributing an answer to Information Security Stack Exchange!
When does content-type must be application / json?
I am testing web application for which business actions are done by sending JSON requests like for example: The problem is that it will be send with header Content-Type: text/plain, but the server only accepts Content-Type: application/json; charset=utf-8.
Can a JSON POST request be rejected with a 400?
Any POST request with a content-type other than application/json will be rejected with a 400. For example, a POST request with content-type application/x-www-form-urlencoded would be thus rejected. All GET requests will be Safe, and thus not modify any server-side data.
What happens if you send a post without a JSON object?
Any POST request without a top-level JSON object, e.g., {“foo”:”bar”}, will be rejected with a 400. For example, a POST request with the content 42 would be thus rejected. Any POST request with a content-type other than application/json will be rejected with a 400.
Why are CSRF attacks possible against web apps?
CSRF attacks are possible against web apps that use cookies for authentication because: Browsers store cookies issued by a web app. Stored cookies include session cookies for authenticated users.
How to manage CSRF token in Redis server?
Here we defined the variable refreshTokens to manage the CSRF or XSRF token that links with refresh token in the form of the object. You can also manage it on redis server. Also we will have a cookie option to create a secure HttpOnly cookie for refresh token and the same option will be used to remove token from the cookie.
When do you need to use CSRF protection?
CSRF attacks depend upon this behavior. If you do not use cookies, and don’t rely on cookies for authentication, then there is absolutely no room for CSRF attacks, and no reason to put in CSRF protection. If you have cookies, especially if you use them for authentication, then you need CSRF protection.
https://www.youtube.com/watch?v=k6yR055yWZ4