Security: Enable CSRF by default?

dadi / web

Web is a drop in front end for websites and web apps. Consumes data from DADI API and others

https://dadi.cloud/en/web/

Other

48 stars 16 forks source link

Closed abovedave closed 6 years ago

abovedave commented 6 years ago

Should this be on by default in the config? Perhaps opens up a wider conversation of how much hand-holding with security we do.

 "security": {
    "csrf": true
  }