I was searching for an CSRF implementation for Express.js, and i found something that get my atention, in this post it says that a JSON API is nos vulnerable to CRSF attacks... is that correct?? is not possible to forge a JSON request to do an unintented operation in this case?


Considering that the allowed encType for forms are application/x-www-form-urlencoded, multipart/form-data and text/plain it totally make sense...


1 Answer 1


They are still susceptible in XSS attacks, plain/text JSON enforcement, and if the origin policies aren't set up correctly. It's been answered before on Stack Overflow, but not here really. The answer on Stack Overflow can be found here but I'll summarize here for archival sake:

Forms are limited to two methods: GET and POST
Forms are limited to three content types: application/x-www-form-urlencoded, multipart/form-data, and text/plain

Since you're posting over content-type application/json you need to use XMLHTTPRequest submission which is locked down with Origin Policies(Same, Cross) so now it depends on the server.

However, if the form generates valid JSON but sets the content type to text/plain and the server doesn't check that then CSRF is still possible if all the server is doing is parsing the data without checking the content type.

So really it's up to the server to check the post request, only allow content-type application/json and use correct origin policies to prevent CSRF with a JSON API. Remember CSRF is always dependent on the server to prevent the attack.

  • In the case that side-effect ops require authentication (a valid session cookie), wouldn't the check for application/json content-type suffice? CROS requests do not include cookies. And in general, if you have CORS enabled with a json API, that's not an CSRF issue no?
    – Izhaki
    Commented Dec 5, 2021 at 1:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .