What I am building is service that can be consumed by third-party. Something like Omdb API for example.

For my service to be functional I needed to disable CSRF on some endpoints.

How can I secure them? To make CORS rules? To whitelist domains or?


Edit: API trusts a few known host, and handles anti CSRF token via framework. Those third-parties will consume our API, but they have to be authorized.

  • 1
    Unfortunately the requirement is very unspecific. It is not clear what you mean with some endpoint, i.e. where CSRF should be allowed and where not. It is also not clear what you mean with endpoint, i.e. browser vs. mobile app etc. I recommend that you describe your setup and environment in more detail and also what the specific risk is you are trying to address (CSRF is not a risk itself, it is a technique). – Steffen Ullrich Mar 25 at 5:38
  • If your authorization mechanism uses a bearer or auth token (basically any kind of auth other than cookies) then you're probably covered for CSRF protection. – Mike Ounsworth Mar 25 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.