Hi All,
We have implemented APIs and secured using BasicAuth and oAuth2 credentials. We have got a situation whereby hosting the script in third-party server and visit the page using previously authenticated browser, it will automatically use the credentials saved in the browser to perform the action.
The APIs mentioned with the POST/PUT are executed so I want to understand how to protect this APIs using CSRF.
In the documentation I see Security > CSRF to enable the CSRF but after enabling this I see APIs are failing with CSRF secure token is not present in the request which is good. But how does API Gateway identify the CSRF token and how does the system calling our APIs generate the CSRF token and gateway validate it
------------------------------
Abhijith Parre
------------------------------