I've recently learned about CSRF, I know that CSRF is for browsers, not apps, which makes sense. but I have a few questions.

if an API is used by both browser (front-end) and apps (iOS/android), what is the best practice here? should I:

  1. protect my endpoint against csrf (e.g. /profile/update, csrf token required), and then get & send the csrf token even from the apps?
  2. or, I should create two different endpoints, one for website (e.g. /profile/update/web, csrf token required), and another one for apps? (e.g. /profile/update/app, no csrf required)
  3. other tactics?

note: I use session cookies.

  • How would you keep someone from abusing the the native app endpoint from a browser? Is there a downside to having the app use the CSRF token? If implemented properly, the server provides the web app or native app with a token to use, so neither client has to do anything fancy. – iraleigh Jul 17 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.