In sum, if I am able to add a custom header to a request, that allows the disabling of CSRF check, will the endpoint be vulnerable to CSRF Attack ?

I'm bit lost.A custom header is such X-SKIP-CSRF: YES.

1 Answer 1


I think here's a whole conversation about custom headers here.

CSRF protection with custom headers (and without validating token)

Hope it helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .