11

I ended up researching CSRF protection on Rest API endpoints, and whether or not they are required. This lead me to this old question:

CSRF protection with custom headers (and without validating token)

Which has been used as a reference to close questions about whether or not Rest APIs need CSRF tokens:

Is it necessary to add CSRF tokens for REST API?

The problem is, I believe that this canonical question started from a false premise which resulted in incorrect answers, and is now being used to close duplicate questions about this topic, which I would very much like to discuss. In detail:

The original question asked "Is it okay to use a custom header to perform CSRF protection on REST endpoints and not validate the token?". What I want to know, but which this question didn't ask, is "Is it necessary to use CSRF protection on REST endpoints at all?". Rather, the question assumed that CSRF protection is required, and got answers that also worked from that assumption.

Having given it a lot of thought, I'm very certain that CSRF protection is not at all helpful to REST endpoints, and that you are better off skipping it altogether. Given this, I think the "standard" thing to do would be to add another answer to the question. However, there is a problem: I would actually like some input about this question myself. While I am pretty sure I am correct (that CSRF is unnecessary here), I'm not 100% certain, and I would like to see what others think. I legitimately want to ask a question. The question I want to ask is not discussed in this canonical question, but this question has been used to close other questions when others asked exactly what I want to ask. I also feel like commenting on the original question or answers is not going to work for me, because this isn't just a matter of clarification: there are a number of details to discuss.

As a result I don't have an answer to my question, and I suspect that if I try to ask my question it will just get closed as a duplicate. This, of course, is why I'm posting this here. What is the best way to proceed? Should I ask my question and start off with a discussion about why it is not a duplicate? I feel like that will detract from the question itself. Can I get some suggestions here and then reference this meta-post if posting another question is the right answer?

2
  • 1
    By the way, I would say the answer is yes and no. You are right that CSRF protection is not needed on REST API when we think about an API used by the backend server. But, I have the feeling that with single page app in javascript and backend only returning json, many users are starting to call their backend a REST API while it's just a backend returning json instead of html... Answering a firm yes/no is impossible without clearly defining what is a REST API.
    – Gudradain
    Commented Aug 4, 2017 at 3:54
  • 1
    @Gudradain Indeed. I posted my question and did some more reading yesterday, and refined my thoughts enough that I posted an answer to my question. A big part of the answer was clarifying what a REST API actually means, and whether or not CSRF protection is required given how your application works regardless of the actual definition of what REST is.
    – Conor Mancone
    Commented Aug 4, 2017 at 13:33

2 Answers 2

Reset to default
9

I would suggest asking your new question, referencing the other question, along with the reason you have posted here as to why what you are asking is different.

That generally is the case whereclosely related (but non-dupe) questions are asked.

I wouldn't suggest the existing one is wrong - it comes at a different question.

1
  • 2
    That last statement is a good point, especially since, after more reading, I have realized that there is a legitimate need for CSRF on Rest APIs in some cases. I think my initial problem with both the question and answer is that it didn't answer the part I wanted to know, but was used to close questions asking what I wanted to know.
    – Conor Mancone
    Commented Aug 3, 2017 at 22:05
2

We are now in an awkward position.

We have a question that has been closed as duplicate when it should not have been closed and a new question that was created to fix this situation.

Now the problem is that I don't think the duplicate on the first question is valid but the first question and the new question are now duplicate of each other.

So the duplicate link should be switched at least.

2
  • 2
    That sounds like a good idea: switch the duplicate link on the older question. It's certainly a bit strange to end up with a question that is closed as a duplicate and references a question that is newer than itself, but that is less confusing than having a question closed for a duplicate and pointing to a question that doesn't actually answer the question. I can't actually make that change myself though.
    – Conor Mancone
    Commented Aug 4, 2017 at 15:02
  • 1
    @ConorMancone Feel free to use the "flag for moderator" button. Since you've asked here, reference this thread.
    – Mike Ounsworth
    Commented Aug 4, 2017 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .