Posting JSON with an HTML Form

david@systemoverlord.com (David Tomaschik) — Wed, 24 Aug 2016 00:00:00 +0000

A coworker and I were looking at an application today that, like so many other modern web applications, offers a RESTful API with JSON being used for serialization of requests/responses. She noted that the application didn’t include any sort of CSRF token and didn’t seem to use any of the headers (X-Requested-With, Referer, Origin, etc.) as a “poor man’s CSRF token”, but since it was posting JSON, was it really vulnerable to CSRF? Yes, yes, definitely yes!

Hacks on System Overlord

Posting JSON with an HTML Form