Django CSRF Protection GraphQL API
I do have a graphqlAPI which I use for CRUD Operations to my database. The authentication is tokenbased. So if an user wants to make cruds (mutations) to my database, it needs a valid token in order to do that.
What I dont know is if my graphql API is also protected against CSRF attacks as I exempt this protection with csrf_exempt
without csrf_exempt it needs a csrf token. Is there a way to ask for a valid csrf token without sending it over the frontend ? The graphql api is only used for the backend for inserting data into the database in which I cant get the csrf token over the frontend.
Backend/Frontend: Django Database: Mongo
Thanks
If the authentication token is transported in a header field (rather than in a cookie), there is no need for CSRF protection. This is because if a user is tricked into making an unwanted request to the endpoint, the browser will not automatically insert the token into the request, so it will be unauthenticated. You could also say that the authentication token already serves as anti-CSRF token.
Browsers will automatically insert (non same-site, non third-party) cookies into requests, by contrast.