Marcus Hill 61777116a9 CSRF Token ...

Upon login, issue the user a CSRF token (in their session). This token should be provided when completing sensitive actions (e.g. deleting companies/clients, changing their password, etc.)

Ref: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern

2022-05-01 18:43:53 +01:00

8.2 KiB

Raw Blame History

View Raw