Spring Security - Third Edition

CSRF protection and JSON

A common question is: do I need to protect JSON requests made by JavaScript? The short answer is, it depends. However, you must be very careful, as there are CSRF exploits that can impact JSON requests. For example, a malicious user can create a CSRF with JSON using the following form:

    <form action="https://example.com/secureTransaction" method="post"       enctype="text/plain">    <input name='{"amount":100,"routingNumber":"maliciousRoutingNumber",    "account":"evilsAccountNumber", "ignore_me":"' value='test"}'    type='hidden'>    <input type="submit" value="Win Money!"/>    </form>This will produce the following JSON structure{ "amount":       100,"routingNumber": "maliciousRoutingNumber","account":  "maliciousAccountNumber","ignore_me": ...