Top "Csrf" questions

Cross Site Request Forgery is a malicious attack to exploit a website's trust in a user's browser.

Symfony CSRF and Ajax

I am trying to implement some ajax functionality in my Symfony 2 project. Using jquery's $.post I want to send some …

ajax symfony csrf
CSRF: Can I use a cookie?

Is it ok to put the CSRF token in a cookie? (and in every form, as a hidden input, so …

security cookies csrf
Having a POST'able API and Django's CSRF Middleware

I have a Django webapp that has both a front-end, web-accessible component and an API that is accessed by a …

django security api csrf
Yii CSRF disable for action

I send same form data from different contollers and subdomain. But in one case I need disable CSRF validation. Example: …

php yii csrf
Spring CSRF token does not work, when the request to be sent is a multipart request

I use, Spring Framework 4.0.0 RELEASE (GA) Spring Security 3.2.0 RELEASE (GA) Struts 2.3.16 In which, I use an in-built security token to …

spring struts2 spring-security csrf csrf-protection
Spring Security: enable / disable CSRF by client type (browser / non-browser )

Spring Security documentation says: "When you use CSRF protection? Our recommendation is to use CSRF protection for any request that …

java spring spring-mvc spring-security csrf
Am I under risk of CSRF attacks in a POST form that doesn't require the user to be logged in?

I'm probably being a total noob here, but I'm still uncertain about what a CSRF (Cross-Site Request Forgery) attack is …

security csrf
Spring Security 3.2 CSRF support for multipart requests

We have been using Spring Security with our application for a few years now. Last week we upgraded Spring Security …

spring spring-mvc spring-security csrf
Rails 4 skipping protect_from_forgery for API actions

I've been implementing a Rails 4 application with an API. I want to be able to call the API from mobile …

ruby-on-rails json api ruby-on-rails-4 csrf
CSRF protection with JSON Web Tokens

I read that when using JWT, there is no need to protect against CSRF attacks, for instance: "since you are …

local-storage csrf jwt auth0