I am wondering about ways to mitigate CSRF attack against JSON RPC interfaces that 1) adhere to best practices and 2) do not restrict the usability of the JSON RPC interface. For example, one mitigation against CSRF would be to only allow certain content-type headers that require a preflight request and then disallowing cross origin request via CORS. This, however, seems to go against best practices. Likewise using CSRF tokens seems to make the JSON-RPC less usable - it also unclear to me how exactly one would implement them. Any other mitigation suggestions?

  • You can require a custom header like X- CSRF-Protection: 1 – paj28 Jul 3 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.