Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • 1
    DOH, should have figured the question was probably about CSRF. I mean, it still might not be, but that's probably the minimum-number-of-misunderstandings path between what was asked and what the asker is actually worried about. Commented Sep 13, 2016 at 22:20
  • @CBHacking - Heh, true. But to be fair with OP, I actually find this misunderstanding quite often when consulting. i.e. Q: How do I secure an unauthenticated REST API? A: You don't, it's unauthenticated. Commented Sep 13, 2016 at 22:32
  • @grochmal I think that one line just reinforced it nicely for me. Thank you. TLDR; Make it authenticated! Commented Sep 13, 2016 at 22:38
  • I suppose what I was trying to highlight was that CORS has this concept of Allowed-Domains (i.e. Access-Control-Allow-Origin) which on the initial look appear to be a mechanism for white listing requests. I was wrong Commented Sep 13, 2016 at 22:49