What I am building is service that can be consumed by third-party. Something like Omdb API for example.
For my service to be functional I needed to disable CSRF on some endpoints.
How can I secure them? To make CORS rules? To whitelist domains or?
Edit: API trusts a few known host, and handles anti CSRF token via framework. Those third-parties will consume our API, but they have to be authorized.