CSRF protection for API requests
In this section, you will learn about different aspects of cross-site request forgery (CSRF or XSRF) attack protection, which need to be taken care in both the Angular app and Spring app. Before getting into details, lets quickly understand what CSRF is.
CSRF is an attack in which attackers lure authenticated users to unknowingly perform undesired action on the website. For example, an attacker can log in as the user, and without the user's knowledge, transfer money from his account to the attacker's account. The following is a typical use-case scenario of a CSRF attack:
- The user logs into the actual website which will later be compromised using the CSRF attack. Once logged in, the website sends token information assigned to a cookie as part of the response.
- While the user is logged in, the attacker lures the user to visit attacker's web page from where the CSRF attack would take place. One such example is the attacker luring the user to click on a link in...
