search

MattGibney / DarkThrone

Lovingly re-creating the DarkThrone experience.
https://darkthronereborn.com
3 stars 2 forks source link

CSRF Mitigation #3

Closed MattGibney closed 7 months ago

MattGibney commented 7 months ago

As the API is currently authenticated with cookies, it's possible to commit CSRF (Cross Site Request Forgery) requests tricking players into performing actions they don't want to.

Switch to authenticating requests using an Authorization header and a Bearer token.

MattGibney commented 7 months ago

The API does implement CORS requiring requests to be made from known origins, however these can be tricked.