Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/...

The Angular app gets a session cookie and sends it in each API call.

The usual CSRF attack would try to execute a script with some API call, such as POST www.example.com/api/deleteUser when the user clicks an evil link www.evil.com.

The question is: if the API server has a properly configured CORS policy, allowing only www.example.com as origin, is it enough to mitigate CSRF attacks?

1 Answer 1


A CORS policy is not sufficient to protect against CSRF attacks in general, but might be in this specific case.

The question is, if the API accepts "simple" request as defined by the CORS specification. These are requests which can be triggered without JavaScript, i.e. by a form upload, embedding an image or similar. In this case the request will be send directly to the server and all what CORS could prevent is that the attacker could read the response. This is thus not sufficient to prevent CSRF, since CSRF about writing the request and thus executing the action at the server.

If the API instead accepts only non-simple requests (for example by requiring a custom HTTP header) then CORS will be a sufficient protection because in this case only a pre-flight request is needed before the actual request and based on the returned CORS policy from this pre-flight request the actual request will not be executed.

  • Steffen, thanks for your answer. If I understood well, If, instead of a cookie, the API server were expecting a custom header (Authorization: Bearer + JWT) and the client had to retrieve it from, let's suppose, the session storage, this scenario wouldn't be vulnerable to CSRF attacks, is this right? Nov 28, 2020 at 20:52
  • @codependent: Correct. With a custom header a pre-flight request will be done by the browser to check the CORS policy first. Nov 28, 2020 at 21:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .