'ASP.NET Core API without razor pages, using separate web app for Front-End and Anti-Forgery tokens - does it make sense?
Is there any point in having to address XSRF/CSRF by the usage of Anti-Forgery tokens for a strict backend API, that in the end will be forced to do cross-site web requests with a single, specific web domain that serves static content to the users?
The Backend API uses cookies to help keep a user authenticated, hence the concerns for CSRF, but by using CORS the backend API will only accept communication with a specific domain.
Is there a problem here? And, if anti-forgery tokens do make sense, how exactly would they be used when the front-end is on an entirely separate domain? It could, be moved to a sub-domain.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|