CSRF TOKEN HOW TO

If a session id is stored in a cookie the browser will automatically send it along with all requests that go back to the original website. It really boils down to the browsers ability to automatically present login credentials for any request by sending along cookies. I think it will help to keep in mind why CSRF protection is necessary in the first place, and the attack vectors it protects against: I may be missing something though, hence this question. As such, enabling CSRF protection on a REST endpoint just introduces some useless code to your application, and I think it should be skipped. I've seen lots of discussion about securing REST endpoints against CSRF attacks, but having given the topic lots of thought, I'm very certain that CSRF tokens on a REST endpoint grant zero additional protection. Is CSRF Protection necessary for Rest API endpoints?

Indeed, many CSRF/Rest questions I've read on this site talk about securing the endpoints via CSRF tokens without actually discussing whether or not it is necessary.

CSRF TOKEN HOW TO

That post discusses how to perform CSRF protection on Rest endpoints without discussing if it is actually necessary. Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap.

Csrf token