--- title: "What is CSRF and how do you protect against it in APIs?" description: "What is CSRF and how do you protect against it in APIs?" author: "ICSM Computer" published: 2025-06-10 updated: 2025-06-10 canonical: https://www.mindstick.com/interview/34226/what-is-csrf-and-how-do-you-protect-against-it-in-apis category: "c#" tags: ["api(s)"] reading_time: 5 minutes --- # What is CSRF and how do you protect against it in APIs? [**CSRF (Cross-Site Request Forgery)**](https://medium.com/@gpiechnik/understanding-the-cross-site-request-forgery-csrf-attack-b1dc2374f83) is a type of web security vulnerability where a malicious website tricks a user's browser into making [**unauthorized requests**](https://www.mindstick.com/interview/34195/how-do-you-protect-forms-authentication-cookies-against-tampering-and-replay-attacks) to a different site where the user is **already authenticated**. ## Example of a CSRF Attack: Let’s say: - You're logged into `https://mybank.com`. - You visit a malicious site: `http://evil.com`. - That site runs JavaScript like: ```html ``` - The browser **automatically includes cookies** for `mybank.com` with that request — even though the request came from a malicious site. ➡ Result: Money transferred without user’s intention. ## CSRF Is a Threat Only When: - **Authentication is cookie-based** (since cookies are automatically sent). - **The user is logged in**. - The attacker can trick the user into loading or submitting a request. ## How to Protect APIs from CSRF | Method | Works With | Description | | --- | --- | --- | | **Anti-Forgery Tokens (CSRF Tokens)** | Cookie-based auth (e.g., MVC, Razor, SPAs with cookies) | Server generates a random token, which the client must send back. Server verifies it. | | **Use Bearer Tokens (e.g., JWT)** | APIs with headers (not cookies) | No cookies → no CSRF risk. Tokens must be manually sent with requests, so attacker can't forge them. | | **SameSite Cookies** | Cookie-based sessions | Set cookies with `SameSite=Strict` or `Lax` so they're **not sent on cross-origin requests**. | | **Disable unsafe HTTP methods** | Public APIs | Accept only `GET` (safe) unless authenticated. | | **Validate Origin or Referer headers** | Browser requests | Server checks if request is from a trusted domain. | ## Most Secure Setup for APIs If your API is: - **Used by a browser with cookies** → use **Anti-Forgery Tokens**. - **Used by SPAs, mobile apps, Postman, etc.** → use **JWTs or API Keys** in `Authorization` headers instead of cookies. ## Why JWT is safer for APIs? - Stored in memory (not cookies). - Must be added to the `Authorization` header by JavaScript: ```plaintext Authorization: Bearer ``` - Attackers cannot forge or steal it with a CSRF attack. ## In Summary | Technique | Prevents CSRF? | Applies To | | --- | --- | --- | | Anti-forgery token | Yes | Cookie-auth apps (e.g., MVC forms, Razor pages) | | JWT / Bearer token in header | Yes | APIs (SPAs, mobile apps) | | SameSite cookies | Yes | Prevents auto-sending cookies cross-site | | Checking `Origin` / `Referer` | Yes | Basic validation layer (not foolproof) | If your Web API is authenticated using **cookies**, and it supports **browser-based users**, you **should** implement CSRF tokens. If you're building a **RESTful API** for SPAs or mobile apps, **use bearer tokens or API keys** — then CSRF is not a concern. Would you like a code example of CSRF protection in: - ASP.NET MVC with Razor views? - Or a token-based authentication setup for Web API? ## Answers ### Answer by ICSM Computer [**CSRF (Cross-Site Request Forgery)**](https://medium.com/@gpiechnik/understanding-the-cross-site-request-forgery-csrf-attack-b1dc2374f83) is a type of web security vulnerability where a malicious website tricks a user's browser into making [**unauthorized requests**](https://www.mindstick.com/interview/34195/how-do-you-protect-forms-authentication-cookies-against-tampering-and-replay-attacks) to a different site where the user is **already authenticated**. ## Example of a CSRF Attack: Let’s say: - You're logged into `https://mybank.com`. - You visit a malicious site: `http://evil.com`. - That site runs JavaScript like: ```html ``` - The browser **automatically includes cookies** for `mybank.com` with that request — even though the request came from a malicious site. ➡ Result: Money transferred without user’s intention. ## CSRF Is a Threat Only When: - **Authentication is cookie-based** (since cookies are automatically sent). - **The user is logged in**. - The attacker can trick the user into loading or submitting a request. ## How to Protect APIs from CSRF | Method | Works With | Description | | --- | --- | --- | | **Anti-Forgery Tokens (CSRF Tokens)** | Cookie-based auth (e.g., MVC, Razor, SPAs with cookies) | Server generates a random token, which the client must send back. Server verifies it. | | **Use Bearer Tokens (e.g., JWT)** | APIs with headers (not cookies) | No cookies → no CSRF risk. Tokens must be manually sent with requests, so attacker can't forge them. | | **SameSite Cookies** | Cookie-based sessions | Set cookies with `SameSite=Strict` or `Lax` so they're **not sent on cross-origin requests**. | | **Disable unsafe HTTP methods** | Public APIs | Accept only `GET` (safe) unless authenticated. | | **Validate Origin or Referer headers** | Browser requests | Server checks if request is from a trusted domain. | ## Most Secure Setup for APIs If your API is: - **Used by a browser with cookies** → use **Anti-Forgery Tokens**. - **Used by SPAs, mobile apps, Postman, etc.** → use **JWTs or API Keys** in `Authorization` headers instead of cookies. ## Why JWT is safer for APIs? - Stored in memory (not cookies). - Must be added to the `Authorization` header by JavaScript: ```plaintext Authorization: Bearer ``` - Attackers cannot forge or steal it with a CSRF attack. ## In Summary | Technique | Prevents CSRF? | Applies To | | --- | --- | --- | | Anti-forgery token | Yes | Cookie-auth apps (e.g., MVC forms, Razor pages) | | JWT / Bearer token in header | Yes | APIs (SPAs, mobile apps) | | SameSite cookies | Yes | Prevents auto-sending cookies cross-site | | Checking `Origin` / `Referer` | Yes | Basic validation layer (not foolproof) | If your Web API is authenticated using **cookies**, and it supports **browser-based users**, you **should** implement CSRF tokens. If you're building a **RESTful API** for SPAs or mobile apps, **use bearer tokens or API keys** — then CSRF is not a concern. Would you like a code example of CSRF protection in: - ASP.NET MVC with Razor views? - Or a token-based authentication setup for Web API? --- Original Source: https://www.mindstick.com/interview/34226/what-is-csrf-and-how-do-you-protect-against-it-in-apis Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.