CSRF revisited
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
decide when CSRF protection is needed.
Planned topics
- CSRF: a malicious site makes your browser send a request that carries your cookie.
- It matters when authentication is by cookie, which the browser adds automatically.
- A pure bearer-token API, where the token is sent in a header by code, is not affected in the same way.
- Cookie-based apps keep CSRF protection on (token or
SameSitecookies). - Do not disable CSRF without being able to say why.
Draft outline details
Demonstration
a table: cookie session vs bearer token: CSRF needed? yes / no.
Check your understanding
Why does a bearer-token API not need CSRF protection?
Show answer
Browsers do not attach the token automatically.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.