CODEWITHSUNDEEP
ajaxcsrf
nakajuice
nakajuice

Reputation: 692

Is application enough secured against CSRF-attacks if I send AJAX requests with jQuery and only validate them X-Requested-With?

According to this article it is enough to validate X-Requested-With header for AJAX requests sent by jQuery. So in this case it is not necessary to implement tokens?

And if yes, where is defined that cross-browser requests are not allowed?

Thanks in advance.

Upvotes: 0

Views: 139

Answers (1)

Spain Train
Spain Train

Reputation: 6006

The article itself says that this method is insufficient:

Warning

The method of preventing CSRF attacks described in this post is now considered to be insufficient. A comment on this post links to more details about an attack that circumvents it.

Upvotes: 1

Related Questions