I have a Single-Page Application, which is basically a consumer to my API which authenticates using the
Now as far as I understand, CSRF works like this in a typical website:
- Find an endpoint that does something harmful like
/delete-accountwhich authenticates with cookies
example.com, put a
<img href="http://mywebsite.com/delete-account">(or whatever for a POST request)
However, to me, it looks like that it is impossible for CSRF attacks to happen in the case of an SPA, even if authentication token is sent as a cookie. The normal procedure is a bit like:
- User visits a page, say
- Server renders page as per the authenticated user (given the auth cookie)
- Web page is returned
- Now if the user wants to delete their account, they could press the button, which would send a request to the API that authenticates requests only by
Now in a CSRF attack:
- Server renders and returns webpage
- Umm, nothing happens?
So my question is, is it fine to not implement any sort of CSRF protection in this case? I'm so afraid of having a security issue regarding that.