Protecting against cross-site request forgery (CSRF)
A CSRF attack is a malicious action that involves sending a request to any website that is already authenticated by the user. This way, it enables the attacker to perform any functionality in the target website via the browser of the user.
The best practice to prevent cross-site request forgery (CSRF) is to append unpredictable challenge tokens to requests and associate them with the user sessions. The unpredictable challenge tokens should be unique per user session or per request. These unpredictable challenge tokens should be verified to make sure the request is valid and is coming from a valid source. If the unpredictable challenge token is not valid, then the request is coming from a source other than the user, and that needs to be blocked.
Minimizing preflight requests
Preflight requests are sent by browsers in order to make sure that the actual requests are trusted by the servers. It means that the server will respond with the details...
