Closed frezik closed 5 years ago
Create a CSRF secret, which is stored for each user in their server-side session. Any API calls that change state (PUT or POST, mostly) should verify the CSRF before doing anything.
PUT
POST
Create a CSRF secret, which is stored for each user in their server-side session. Any API calls that change state (
PUTorPOST, mostly) should verify the CSRF before doing anything.