I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication.
My current plan is to add a POST-Endpoint
On first glance, this should prevent CSRF, since it requires two POST-Requests to modify the state of the application. The
<form>-based examples of CSRF I found only submit one POST request, and the response is not visible to the attacker.
Is there something I am missing?
This scenario is similar, except that it is using cookies instead of Windows-Authentication.