Cloud + data orchestration: Demolish your data silos. Enable complex analytics. Eliminate I/O bottlenecks. Learn the essentials (and more)!
2024 DZone Community Survey: SMEs wanted! Help shape the future of DZone. Share your insights and enter to win swag!
Stats
Reputation: | 1632 |
Pageviews: | 576.3K |
Articles: | 24 |
Comments: | 5 |
Comments
Apr 17, 2020 · Lawrence Ebringer
Thanks Mukesh!
Apr 17, 2020 · Lawrence Ebringer
Thanks Tugce!
Feb 20, 2020 · Lawrence Ebringer
Jun 14, 2017 · Derric Gilling
Yes, you can install it at: https://chrome.google.com/webstore/detail/apirequestio-ajax-capture/aeojbjinmmhjenohjehcidmappiodhjm
Feb 19, 2017 · Derric Gilling
Can the API be called by browser web apps via AJAX, or only native devices?
If you call your API via cross origin AJAX requests, you can easily check the Origin Request Header if it matches your domain as part of CORS and ensure you set the appropiate Access-Control-Allow-Origin header, which is what we do at Moesif.
https://www.moesif.com/blog/technical/cors/Authoritative-Guide-to-CORS-Cross-Origin-Resource-Sharing-for-REST-APIs/
This is also helpful:
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
I didn't fully understand this question "s there need to exclude those endpoints from CSRF protection even those REST endpoints are called from JavaScript?"
What is you thinking of a reason to exclude REST endpoints from CSRF?