I was pentesting a Json Rest API today; the API needs a specific header to be sent:- Content-Type: application/json which doesn't allow CSRF attacks.
The only option I was left with was sending cross domain requests since there is no CORS policy set. However while trying sending xhr POSTs with the "content-type" header the browser sends OPTIONS request to the endpoint and triggers a 403 disallowing to POST. I've tried bypassing this using plain/text and other headers but none of them seems to work.
Do you have any ideas on how to proceed on this? I've heard that sending the same via an SWF file would work but have to try it out.