Skip to content

Comment on Apache Wicket's encrypted URLs don't protect from CSRFparent

Comments

You'll notice a lot of people just have X-CSRF.* header (Stripe for example if you want to check one out). In my opinion you might as well just go the full 9 and actually implement an anti-CSRF solution instead of a quick hack.

x-Requested-By works but your webapp can be built in a way that things like insecure redirects fool you app.

The best solution is just to use tokens.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.