I've recently learned about CSRF, I know that CSRF is for browsers, not apps, which makes sense. but I have a few questions.
if an API is used by both browser (front-end) and apps (iOS/android), what is the best practice here? should I:
- protect my endpoint against csrf (e.g. /profile/update, csrf token required), and then get & send the csrf token even from the apps?
- or, I should create two different endpoints, one for website (e.g. /profile/update/web, csrf token required), and another one for apps? (e.g. /profile/update/app, no csrf required)
- other tactics?
note: I use session cookies.